Dynamic Section using Context

[Moh.Yasser]

I was wondering how we can add splunk results into Incident layout. Possibly a CSV file or markdown.

We use splunk to search our email logs to see other recipients who got phishing email. Wanted to display that in the Incident layout.

Any advise is highly appreciated. Thank you.

[MBeauchamp2]

Assuming you've run the search and the results are in context (usually under Splunk.Result), then yes you can use a dynamic section on your Incident layout to display the results in Markdown format.

Those are a type of automation, and there is a super awesome training video that explains how to write your own (video 19):

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success...

There are also some useful examples of dynamic sections in the Case Management Pack that you can use as a reference: (CaseMgmtAnalystTools, CaseMgmtDisplayLabels, CaseMgmtResponseProcess) - https://cortex.marketplace.pan.dev/marketplace/details/CaseManagementGeneric/

[Moh.Yasser]

@MBeauchamp2 Thank you.

I found the results. Would I be able to attach the file in the layout? After exporting to CSV?

[MBeauchamp2 · Accepted solution]

Dynamic sections won't display a file to be downloaded, it's more displaying in a markdown table for review via the XSOAR UI.

If you want a file then you could use the ExportToCSV automation to export it, and then in the layout there is a Incident Files or Incident Attachments section that they could grab it from.

Or you could tag the file entry in the war room (Details Tab on the Task) and use the War Room Entries section to display entries with that tag.