How to Customize Incident Phase Values

How to Customize Incident Phase Values

0
Created On 04/27/20 07:53 AM - Last Modified 07/19/22 23:17 PM


Objective


Customize the default incident phase values. 

The default incident phase values are:

  • Triage
  • Containment
  • Investigation
  • Response

    Environment


    Cortex xSOAR

    Procedure


    1. Go to Settings > About > Troubleshooting > Server Configuration.
    2. Click Add Server Configuration.
    • Key: incident.phase
    • Value: a comma-separated list of incident phase values.
    Example:
    User-added image
    Other users also viewed:
    Actions
    • Print
    • Copy Link

      https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPoiCAG&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail