Create a Threat Intel Report type

Create Threat Intel Report types in Cortex XSOAR 8 SaaS.

Threat intel reports are categorized by type, which determines the layout that is displayed for the report.

You can create new threat intel report types to support use cases not covered by the out-of-the-box types, which may require different report layouts. For example, you may want to add a new type for a specific threat-hunting report that your organization needs, which is not covered by one of the out-of-the-box template types.

If you want to customize a report type by attaching a new layout, you need to detach the existing report type. If you detach it, it does not receive content pack updates. If you reattach it, any content pack updates override any changes made.

Note

If you disable the report, it is not available for selection when you create a report.

You cannot delete out-of-the-box report types.

Before creating a Threat Intel Report type, review, customize, or create a new layout, which is then added to the report type.

1. Select Settings & Info → Settings → Object Setup → Threat Intel Reports → Types → New Type.
2. Enter a name and select the layout you want to use.

   You can leave this blank and add the layout later.
3. (Multi-tenant only) Add or select Propagation labels. You can also view any dependencies.
4. Save the type.