> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-field.md).

# Create a Threat Intel Report field

Add/create Threat Intel Report fields to populate a report layout with relevant data.

<details>

<summary>Field types</summary>

| Field Type         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Boolean            | Checkbox                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Date picker        | Adds the date to the field                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Grid (table)       | <p>Include an interactive, editable grid as a field type for selected report types or all report types. To see how to create a grid field and to use a script, see Create a grid field for an incident type.</p><p>When you select Grid (table) you can format the table and determine if the user can add rows,</p>                                                                                                                                                                                                         |
| HTML               | HTML: Create and view HTML content, which can be used in any type of report.                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Long text          | <ul><li>Long text is analyzed and tokenized, and entries are indexed as individual words, enabling you to perform advanced searches and use wildcards.</li><li>Long text fields cannot be sorted and cannot be used in graphical dashboard widgets.</li><li>While editing a long text field, pressing enter will create a new line. Case insensitive.</li></ul><p>Add a placeholder if required.</p>                                                                                                                         |
| Markdown           | Add markdown-formatted text as a Template which will be displayed to users in the field after the indicator is created. Markdown lets you add basic formatting to text to provide a better end-user experience.                                                                                                                                                                                                                                                                                                              |
| Multi select/Array | <p>Select the following options:</p><ul><li>Multi-select from a prefilled (static) list.</li><li>An empty array field for the user to add one or more values as a comma-separated list.</li></ul><p>Add a placeholder if required.</p>                                                                                                                                                                                                                                                                                       |
| Number             | Can contain any number. Default is 0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Role               | The role assigned to the Threat Intel Report determines which users (by role) can view the report.                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Short Text         | <ul><li>Short text is treated as a single unit of text and is not indexed by word. Advanced search, including wildcards, is not supported.</li><li>Short text fields are case-sensitive by default but can be changed to case-insensitive when creating the field.</li><li>While editing a short text field, pressing enter will save and close.</li><li>Maximum length 60,000 characters.</li></ul><p>Recommended use is one-word entries, such as username and email address.</p><p>Select a placeholder, if required.</p> |
| Single select      | Select a value from a list of options. Add comma-separated values.                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Tags               | <p>Accepts a single tag or a comma-separated list, not case-sensitive.</p><p>Add a placeholder if required.</p>                                                                                                                                                                                                                                                                                                                                                                                                              |
| Timer/SLA          | Set up when an SLA is due, the risk threshold, and configure actions to take if the SLA does pass.                                                                                                                                                                                                                                                                                                                                                                                                                           |
| URL                | Add a URL when completing the field.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| User               | A user in Cortex XSOAR.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

</details>

<details>

<summary>How to create a new field</summary>

1. Select **Settings & Info** → **Settings** → **Object Setup** → **Threat Intel Reports** → **Fields** → **New Field**.
2. Select the relevant field type.
3. Complete the following fields:

   | Parameter  | Description                                                                                                                                                                                                          |
   | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Mandatory  | If selected, this field is mandatory when used in a form.                                                                                                                                                            |
   | Field Name | A meaningful display name for the field. After you type a name, you will see below the field that the **Machine name** is automatically populated. The field’s machine name is applicable for searching and the CLI. |
   | Tooltip    | An optional tooltip for the field.                                                                                                                                                                                   |
4. Configure the attributes:

   | Name                                                              | Description                                                                                                                                                                                                                                                    |
   | ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Script to run when field value changes                            | The script dynamically changes the field value when script conditions are met. For a script to be available, it must have the **`field-change-triggered-ThreatIntelReport`** tag, which is added when defining a script.                                       |
   | Run the field triggered script after the new field value is saved | By default, the script executes before the threat intel report is stored in the database. If you select this option, the script instead executes after the threat intel report is modified, so that the script cannot make changes to the threat intel report. |
   | Add to all Threat Intel Report types                              | Determines which threat intel report types have this field available. By default, fields are available to all types. To change this, clear the checkbox and select the specific threat intel report types.                                                     |
   | Make data available for search                                    | Determines if the values in these fields are available when searching. Enabled by default.                                                                                                                                                                     |
5. (Multi-tenant only) In the Propagation tab, add or select Propagation labels. You can also view any dependencies.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-field.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.