> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-fields.md).
# Configure Threat Intel Report Fields
Use fields to populate a report with relevant data. Fields are included with, and can be added to, report layouts. You can add custom threat intel report fields that don’t exist in Cortex XSOAR out-of-the-box, and then add them to threat intel report layouts
{% hint style="info" %}
### Note
Out-of-the-box fields that have been installed from a content pack, such as the Threat Intel Reports (BETA) content pack, are automatically added to the relevant layout. To remove the field from the layout, you need to duplicate or detach the layout. You cannot edit these fields, apart from selecting whether to add the field to Threat Intel types and whether the field is mandatory.
{% endhint %}
1. Go to Settings → OBJECTS SETUP → Threat Intel Reports → **Fields**.
2. Add a **New Field**.
3. Configure the basic settings.
| Field | Description |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Field Name | A meaningful display name for the field. After you type a name, you will see below the field that the **Machine name** is automatically populated. The field’s machine name is applicable for searching and for the CLI. |
| Tooltip | An optional tooltip for the field. |
| Field Type | Determines the acceptable values for the field. You can add the following field types:
Boolean (checkbox)
Date picker
Grid (table): Include an interactive, editable grid.
HTML: Create and view HTML content, which can be used in any type of indicator. By default, HTML fields do not use Cortex XSOAR theme styles, but can be configured to use existing user themes.
Long text: Long text is analyzed and tokenized, and entries are indexed as individual words, enabling you to perform advanced searches and use wildcards. Long text fields cannot be sorted and cannot be used in graphical dashboard widgets. While editing a long text field, pressing enter will create a newline. Case insensitive.
Markdown: Add markdown-formatted text as a Template that will be displayed to users in the field after the report is created. Markdown lets you add basic formatting to text to provide a better end-user experience. A user-friendly Markdown Editor 
is available when you inline edit the field, which lets you easily apply styles.
Multi select / Array: Includes two options a) Multi select from a pre-filled list b) An empty array field for the user to add one or more values as a comma-separated list.
Number: Can contain any number. Default is 0.
Role: Role assigned to the threat intel report, determines which users (by role) can view the report.
Short text: Short text is treated as a single unit of text, and is not indexed by word. Advanced search, including wildcards, is not supported. Short text fields are case sensitive by default, but can be changed to case insensitive when creating the field. While editing a short text field, pressing Enter will save and close. Maximum length 60,000 characters. Recommended use is one-word entries. Examples: username, email address, etc.
Single select
Tags
Timer/SLA
URL
User: A user in the system.
|
| Case Sensitive | If selected, the field is case sensitive, which affects how the search results for this field are returned in Cortex XSOAR. |
| Mandatory | If selected, this field is mandatory when used in a form. |
| Placeholder | Optional text to display in the field when it is empty. This text will appear in the layout, but not in the created report. Available for Short text, Long text, Multi select / Array, Tags. |
4. Configure the attributes.
| Name | Description |
| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Script to run when field value changes | The script that dynamically changes the field value when script conditions are met. For a script to be available for use here, it must have the **`field-change-triggered-ThreatIntelReport`** tag, which is added when defining an automation. |
| Run triggered script after Threat Intel Report is modified | Executes after the threat intel report is modified, instead of before. By default, the triggered script executes before report modification. |
| Add to all Threat Intel Report types | Determines for which threat intel report types this field is available. By default, fields are available to all types. To change this, clear the checkbox and select the specific types to which the field is available. |
| Make data available for search | Determines if the values in these fields are available when searching. By default, this is enabled. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-fields.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.