> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/create-an-evidence-field.md). # Create an evidence field Evidence fields are custom fields used to capture structured, specific information about artifacts marked as evidence during an incident investigation. Unlike incident fields, evidence fields are not tied to a specific incident type and can be added to any piece of evidence across your system. Evidence fields are primarily created for auditing and regulatory compliance to answer critical questions about what happened during an incident. When an analyst marks an item as evidence in the **War Room**, any custom evidence fields you configure automatically appear under the custom fields section of the **Mark as Evidence** dialog box. After the analyst populates these fields, the custom data is displayed in an expandable custom fields section directly on the **Evidence Board**. {% hint style="info" %} ### Note Cortex XSOAR has a limit of 1000 evidence fields, including system fields, fields you create manually, and any fields in installed content packs. {% endhint %} You can select from a variety of field types when creating an evidence field:
Field types You can create the following field types: | Field Type | Description | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Boolean | Checkbox | | Date picker | Adds the date to the field. | | Long text |

Add a placeholder, if required.

| | Markdown | Add markdown-formatted text as a template that will be displayed to users in the field after the indicator has been created. Markdown lets you add basic formatting to text to provide a better end-user experience. | | Multi select / Array |

Select the following options:

Add a placeholder, if required.

| | Number | Can contain any number. Default is 0. | | Role | Role assigned to the evidence. Determines which users (by role) can view the evidence. | | Short Text | | | Single select | Select a value from a list of options. Add comma-separated values. | | URL | Add a URL when completing the field. | | User | A user in Cortex XSOAR. |
1. Go to Settings & Info → Settings → Object Setup → Incidents → Evidence Fields → **New Field**. To edit an existing custom evidence field, right-click the field name and select **Edit**. 2. Select the relevant field type. 3. Add the following information: | Parameter | Description | | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Field Name | A meaningful display name for the field. After you type a name, you will see below the field that the **Machine name** is automatically populated. The field’s machine name is applicable for searching and the CLI. The field name must be unique, start with a letter, and contain only ASCII characters. | | Mandatory | Select this checkbox if the field must be completed. | | Tooltip | An optional tooltip for the field. | 4. (Optional) In the **Basic Settings** tab, define the values according to the select field type. | Parameter | Description | | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | Placeholder | Optional text to display in the field when it is empty. Placeholder text can be provided for short text, long text, and multi-select/ array field types. | | Values | A comma-separated list of values that are valid for the field. Available for multi select/array and single select field types. | | Template | Available for markdown fields. | 5. In the **Attributes** tab, configure the indexing. By default, data in the field is available for search. If you do not want to include this field in search results, clear the checkbox for **Make data available for search**. 6. Click **Save** to create the field. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/create-an-evidence-field.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.