> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-incident.md).

# Create a widget from an incident

Although there are various out-of-the-box system widgets available, you can create custom widgets from incidents and then add them to a dashboard or report.

To create a widget from an incident, you need to run a query from the **Incidents** page and then save the visual results as a widget.

1. In the **Incidents** page, from the dropdown list select the date range.
2. In the **Query** field, type the query criteria as required and run the query.
3. Click ![create-widget-2.png](/files/SkNC8kvO0bQ3KpbzDHdI).
4. Follow the procedure from Task 2. Define the widget data in [Create a widget using the widget builder](/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-using-the-widget-builder.md).
5. Click **Save**.

   The widget is added to the **Widgets Library**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>By default, the widget inherits the date range that you specify when creating the widget, but you can modify the date range when you create the dashboard or report. If the date range for the report or dashboard does not include the widget date range, the data is blank. To override the dashboard or report’s date range, click <strong>Use Widget’s date range</strong>.</p></div>

**Create a widget from an incident example**

In the following example, create a widget that contains:

* Incidents created in the last 6 months
* Status: Every status other than closed
* Category: All categories other than jobs
* Use Access Investigation - Generic playbook

1. In the **Incidents** page, run the following query:

   ![query\_incidents.png](/files/3JfveAGCdYr24jSkFhSN)
2. Click ![create-widget.png](/files/AAPYxavgbhiZksE2oU1I).
3. Type the name (Closed Job Incidents (past 6 months)) and save the query results as a widget:

   ![quick-chart.png](/files/NZScbBp2fxvLZaKnD7fq)
4. Add/Edit a dashboard and locate the widget:

   ![widgets\_library.png](/files/eTWX8HTnV9DKS3tu6lQj)
5. Add the widget to the dashboard. If no data is returned, click **Use widget’s date range**.

   ![use-widget-date.png](/files/BoZtied0C6WZ7hQ1q7w4)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-incident.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.