> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-widget-from-an-incident.md).

# Create a Widget From an Incident

Although there are various out-of-the-box system widgets available, you can create custom widgets from incidents and then add them to a dashboard or report. You can also [create a widget in the widgets library](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-widget-using-the-widget-builder.md).

To create a widget from an incident, you need to run a query from the Incidents page and then save the visual results as a widget. For an example, see [Create a Widget From an Incident Example](#UUID-b7a4a609-7073-3385-0b02-3c53ff594440).

1. In the **Incidents** page, from the drop down list select the date range.
2. In the query field, type the query criteria as required and run the query.
3. Click ![create-widget.png](/files/ifNJC1XClhtv7IXwtHLD).
4. Follow the procedure in [Create a Widget using the Widget Builder](/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-widget-using-the-widget-builder.md).
5. Click **Save**.

   The widget is added to the **Widgets Library**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>By default, the widget inherits the date range that you specify when creating the widget, but you can modify the date range when you create the dashboard or report. If the date range for the report or dashboard does not include the widget date range, the data is blank. To override the dashboard or report’s date range, click <strong>Use Widget’s date range</strong>.</p></div>

**Create a Widget From an Incident Example**

In the following example, you need to create a widget that contains:

* Incidents created in the last 6 months
* Status: Every status other than closed
* Category: All categories other than jobs
* Use Access Investigation - Generic playbook

1. In the Incidents page, run the following query:

   ![query\_incidents.png](/files/M8rAoboW16HnMqio71Cn)
2. Click type the name (Closed Job Incidents with Access Investigation (past 6 months)) and save the query results as a widget:

   ![quick\_definitions\_window.png](/files/SJsseCyUIHn1QoNsvKh2)
3. Add/Edit a dashboard and locate the widget:

   ![widgets\_library.png](/files/ggo867VJNfwOXdSnpwgi)
4. Add the widget to the dashboard. If no data is returned, click **Use widget’s date range**.

   ![widget\_use\_date.png](/files/fijyP9IEVJofzpn7wevv)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-widget-from-an-incident.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.