Indicator enrichment detail in layout

[MKececioglu]

Hi,

In one of our playbook there are 2 enrichment type of integrations deployed for ip enrichment (virustotal and abusedb) all works well as expected and they feed indicator itself but shows only verdict in indicator layout although these enrichments return much more detailed data. I need help about visualize this detailed post-indicator-enrichment data into layout.

These are the data i mentioned and i dont want my analyst to waste time into browsing to this pages.

Best regards.

[jfernandes1 · Accepted solution]

Hi @MKececioglu,

There are 2 places you can see indicator information. 

1. As a part of the indicators table added to a layout. You can customise the displayed columns by click on the gear cog while editing the layout.

2. You can also click on the indicator's value field like above or in the warroom, this will display the indicator quick view panel. The contents of this panel can be customised inside the indicator layout.

The information you require must exist inside a defined indicator field. I would suggest you:-

1. Identify what information your analyst require

2. Identify where the information is stored inside the indicator

3. If stored inside a field, customise the layout

4. If not, configure a job or mapper to populate those fields for future indicators. Then customise the layout.