> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-custom-incident-field.md).
# Create a Custom Incident Field
You can define custom incident fields based on the information you want to display in your Incident Type layouts, as well as the information ingested from third-party integrations.
If you try to create a new incident field with a name that already exists in the system such as **`Account`**, you may receive a message similar to this: **`[Could not create incidentfield with ID '' and name 'Account'. Field already exists as a builtin field (100709)]`**. If so, you should select a different name as the incident field is already reserved for system use.
You should not create a custom field named **`reason`** as it is a saved keyword in the server.
1. Select Settings → OBJECTS SETUP → Incidents → Incident Fields.
Depending on the field type, you can determine if the field contents are case-sensitive, as well as if the field is mandatory.
2. Click +New Field.
3. Complete the following parameters:
| Field | Description |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Field Type | Determines the acceptable values for the field. For example:
- Grid (table): Include an interactive, editable grid.
- HTML: Create and view HTML content, which can be used in any type of indicator. By default, HTML fields do not use Cortex XSOAR theme styles, but can be configured to use existing user themes.
- Long text: Long text is analyzed and tokenized, and entries are indexed as individual words, enabling you to perform advanced searches and use wildcards. Long text fields cannot be sorted and cannot be used in graphical dashboard widgets. While editing a long text field, pressing enter will create a new line. Case is insensitive.
- Markdown: Add markdown-formatted text as a Template which will be displayed to users in the field after the indicator is created. Markdown lets you add basic formatting to text to provide a better end-user experience.
- Multi select / Array: Includes two options a) Multi select from a pre-filled list b) An empty array field for the user to add one or more values as a comma-separated list.
- Number: Can contain any number. Default is 0.
- Role: Role assigned to the incident, determines which users (by role) can view the incident.
- Short text: Short text is treated as a single unit of text, and is not indexed by word. Advanced search, including wildcards, is not supported. Short text fields are case sensitive by default, but can be changed to case insensitive when creating the field. While editing a short text field, pressing enter will save and close. Maximum length 60,000 characters. Recommended use is one word entries. Examples: username, email address, etc.
- User: A user in the system.
|
| Case Sensitive | If selected, the field is case sensitive, which affects how the search results for this field are returned in Cortex XSOAR. |
| Mandatory | The mandatory field is only enforced when using a form (such as creating an incident) or when directly calling the Incident creation API. If incidents are ingested from an integration, the field is not enforced. |
| Field Name | A descriptive name indicating the information that the field contains. |
| Tooltip | (Optional) Additional information you want to make available to users of this field. |
4. If relevant to the field type, add the [Basic Settings](/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields.md).
If adding a grid, see [Create a Grid Field for an Incident Type](/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-grid-field-for-an-incident-type.md).
5. In the **Attributes** tab, add the [attribute parameters](/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields.md).
6. Click Save.
7. To add the field to a system incident type:
1. Go to Settings → OBJECTS SETUP → Incidents → Types.
2. Select the checkbox for the incident type you want to edit.
3. Click Duplicate. A copy of the incident type appears with the string \_copy appended to the name of the incident type. If more than one copy of the incident type is created, a number is appended to the \_copy string. The number is increased with each additional duplication.
4. Click the name of the newly created incident type.
You are presented with the current layout, which is populated with demo data so you can see how the fields fit.
8. To add the field to a custom incident type:
1. Go to Settings → OBJECTS SETUP → Incidents → Types.
2. Select the incident type whose layout you want to edit and click the Edit Layout.
You are presented with the current layout, which is populated with demo data so you can see how the fields fit.
Make sure you select an incident type where the Layout field is empty.
9. In the Library dialog box, in the Cortex XSOAR Sections tab, drag and drop New Section on to the required tab.
| [](https://docs-cortex.paloaltonetworks.com/viewer/attachment/CU0TUYCFeDk8woDfiitS5g/QoGebrHW4wFxV4k6V8zOsQ-CU0TUYCFeDk8woDfiitS5g) |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
10. In the Incident field tab, drag and drop the field that you have created into the New Section.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-custom-incident-field.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.