Create a Widget From an Incident

Create widgets from incident searches in Cortex XSOAR 6.13.

Although there are various out-of-the-box system widgets available, you can create custom widgets from incidents and then add them to a dashboard or report. You can also create a widget in the widgets library.

To create a widget from an incident, you need to run a query from the Incidents page and then save the visual results as a widget. For an example, see Create a Widget From an Incident Example.

1. In the Incidents page, from the drop down list select the date range.
2. In the query field, type the query criteria as required and run the query.
3. Click .
4. Follow the procedure in Create a Widget using the Widget Builder.
5. Click Save.

   The widget is added to the Widgets Library.

   Note

   By default, the widget inherits the date range that you specify when creating the widget, but you can modify the date range when you create the dashboard or report. If the date range for the report or dashboard does not include the widget date range, the data is blank. To override the dashboard or report’s date range, click Use Widget’s date range.

Create a Widget From an Incident Example

In the following example, you need to create a widget that contains:

• Incidents created in the last 6 months
• Status: Every status other than closed
• Category: All categories other than jobs
• Use Access Investigation - Generic playbook

1. In the Incidents page, run the following query:

   

   query_incidents.png
2. Click type the name (Closed Job Incidents with Access Investigation (past 6 months)) and save the query results as a widget:

   

   quick_definitions_window.png
3. Add/Edit a dashboard and locate the widget:

   

   widgets_library.png
4. Add the widget to the dashboard. If no data is returned, click Use widget’s date range.

   

   widget_use_date.png