> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization/examples-of-using-scripts-in-incident-layouts.md).
# Examples of using scripts in incident layouts
The following are examples of scripts that are supported in incident layouts:
Charts
A valid result for a chart widget is a list of groups. Each group points to a single entity. For example, in bar charts, each group is a bar. A group consists of the following:
* `Name`: A string.
* `Data`: An array of integers.
* `Color`: A string representing a color that will be used as a default color for that group. It can be the name of the color, a hexadecimal representation of the color, or an RGB color value (optional).
* `Groups`: A nested list of groups (optional).
Horizontal bar
In this example, create a script in Python that displays a horizontal bar of the indicators by severity.
After you have uploaded the script and created the widget, you can add the widget to an incident layout. The following widget displays:
Vertical bar
In this example, create a script in Python that displays a vertical bar of the indicators by severity.
After you have uploaded the script and created the widget, you can add the widget to an incident layout. The following widget displays:
Stacked bar
In this example, create a script in Python that displays a stacked bar showing the successes and failures on specific dates.
After you have uploaded the script and created the widget, you can add the widget to an incident layout. The following widget displays:
Line chart
In this example, we create a JavaScript that displays how many GitHub issues were created each week for Content, Documentation, and Platform in a line chart.
After you have uploaded the script and created the widget, you can add the widget to an incident layout. The following widget displays:
Pie
In this example, create a script in Python that queries and returns a pie chart.
```programlisting
data = {
"Type": 17,
"ContentsFormat": "pie",
"Contents": {
"stats": [
{
"data": [
1
],
"groups": None,
"name": "high",
"label": "incident.severity.high",
"color": "rgb(255, 23, 68)"
},
{
"data": [
1
],
"groups": None,
"name": "medium",
"label": "incident.severity.medium",
"color": "rgb(255, 144, 0)"
},
{
"data": [
2
],
"groups": None,
"name": "low",
"label": "incident.severity.low",
"color": "rgb(0, 205, 51)"
},
{
"data": [
8
],
"groups": None,
"name": "unknown",
"label": "incident.severity.unknown",
"color": "rgb(197, 197, 197)"
}
],
"params": {
"layout": "horizontal"
}
}
}
demisto.results(data)
```
After you have uploaded the script and created the widget, you can add the widget to an incident layout. The following widget displays indicator severity as a pie chart:
Duration
In this example, create a script in Python that queries and returns a time duration (specified in seconds), and displays the data as a countdown clock.
```programlisting
data = {
"Type": 17,
"ContentsFormat": "duration",
"Contents": {
"stats": 60 * (30 + 10 * 60 + 3 * 60 * 24),
"params": {
"layout": "horizontal",
"name": "Lala",
"sign": "@",
"colors": {
"items": {
"#00CD33": {
"value": 10
},
"#FAC100": {
"value": 20
},
"green": {
"value": 40
}
}
},
"type": "above"
}
}
}
demisto.results(data)
```
After you have uploaded the script and created the widget, you can add the widget to an incident layout. The following widget displays the time duration:
Number
This example shows how to create a single item widget that displays a number.
```programlisting
data = {
"Type": 17,
"ContentsFormat": "number",
"Contents": {
"stats": 53,
"params": {
"layout": "horizontal",
"name": "Lala",
"sign": "@",
"colors": {
"items": {
"#00CD33": {
"value": 10
},
"#FAC100": {
"value": 20
},
"green": {
"value": 40
}
}
},
"type": "above"
}
}
}
demisto.results(data)
```
After you have uploaded the script and created the widget, you can add the widget to an incident layout. The following widget displays:
Number Trend
This example shows how to create a single-item widget that displays a number trend.
```programlisting
data = {
"Type": 17,
"ContentsFormat": "number",
"Contents": {
"stats": { "prevSum": 53, "currSum": 60 },
"params": {
"layout": "horizontal",
"name": "Lala",
"sign": "@",
"colors": {
"items": {
"#00CD33": {
"value": 10
},
"#FAC100": {
"value": 20
},
"green": {
"value": 40
}
}
},
"type": "above"
}
}
}
demisto.results(data)
```
After you have uploaded the script and created the widget, you can add the widget to an incident layout. The following widget displays:
Add note information
This example shows how to add note information to an incident layout using a script through the API.
1. Install the Cortex REST API content pack and add a Core REST API instance.
2. Go to the **Scripts** page and add the following script:
```programlisting
commonfields:
id: ShowLastNoteUserAndDate
version: -1
name: ShowLastNoteUserAndDate
script: |2
function getLastNote(incidentID) {
var body = {pageSize:1,categories:['notes']};
var res = executeCommand('demisto-api-post', {uri:'/investigation/' + incidentID, body: body});
if (isError(res[0])) {
throw 'demisto-api-post failed for incidnet #'+incidentID+'\nbody is ' + JSON.stringify(body) + '\n' + JSON.stringify(res);
}
if (!res[0].Contents.response.entries) {
return null;
}
var notes = res[0].Contents.response.entries;
var lastNote = notes[notes.length-1];
return lastNote;
}
lastNote = getLastNote(incidents[0].id);
if (lastNote) {
md = `#### Update by ${lastNote.user} on ${lastNote.modified.split('T')[0]}\n`;
md += `\n---\n`;
md += lastNote.contents + '\n';
return { ContentsFormat: formats.markdown, Type: entryTypes.note, Contents: md } ;
} else {
return 'N/A';
}
type: javascript
tags:
- dynamic-section
enabled: true
scripttarget: 0
runonce: false
runas: DBotWeakRole
```
3. Add the script to the layout and then add the layout to the incident type.
4. Go to the incident to view the note information.
You can see note information, containing the last user and date.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization/examples-of-using-scripts-in-incident-layouts.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.