Morpheus Forms

Last Updated: October 23, 2026

Overview

Morpheus Forms lets you build web forms that collect information from people and turn each submission into an incident, so requests and reports reach your SOC in a consistent, structured shape instead of arriving as free-form emails. You build a form from fields such as text, dates, dropdowns and checkboxes, publish it to one or more sites with the playbook and incident type it should use, and decide which answers fill which incident fields. Signed-in users can find the forms you share with them in the Portal.

To open it, go to Configuration > Morpheus Forms, in the MANAGEMENT group of the sidebar. The page has three tabs:

In Short

The Forms List

The Forms tab lists every form you can manage, so you can see at a glance which forms are live, on how many sites, and which version is published.

The Forms list

Use Site to show only the forms of one site, and Search forms… to find a form by name. When nothing matches, the list says so and suggests clearing the search. The refresh button next to New Form reloads the list.

Creating a Form

A new form can start from a template that already holds suitable questions, or from a blank form. Either way you can change everything afterwards in the builder.

1. On the Forms tab, select New Form.

2. In the New form window, pick a starting point:

   • New blank form;

   • Approval: approve or reject a request with optional notes;

   • Phishing Report: collect details about a suspected phishing email;

   • Incident Triage: initial severity assessment and scope of impact;

   • Access Request: request access to a resource with justification;

   • IOC Submission: submit an indicator of compromise for investigation.

3. Enter a Name and choose the Site the form belongs to. Both are required. A Description is optional.

4. Select Create.

The New form window

Building a Form

The builder is where you add the questions, set the rules for each one, and choose what the person filling in the form sees before and after they submit. It has three columns: the list of elements on the left, the form itself in the centre, and the settings of whatever you have selected on the right.

Building a form, step by step

The form builder

The top of the builder shows the form's name and description and these controls:

Your changes are saved to the draft as you work: a Draft saved note appears next to the status. Nothing reaches the people who use the form until you publish.

Adding Elements

Select Add element to add a question or a piece of content, then pick the element from the menu.

The Add element menu

To arrange the form:

• drag an element in the left-hand list by its handle to change its place;

• on a selected element, use Move up, Move down, Duplicate, Copy element or Delete;

• Paste element, next to Add element, pastes an element you copied.

Setting Up a Field

Select an element to show its settings on the right. Most input fields have these groups:

The settings of a Date field

Showing a Field Only When It Is Needed

A condition keeps a form short: a field appears only when earlier answers make it relevant. For example, the Additional details box can stay hidden until the person has entered an email subject.

1. Select the field that should appear conditionally.

2. In CONDITION, turn on Show this field conditionally.

3. Set the rule: choose the earlier question, then an operator (equals, does not equal, contains, is empty or is not empty) and, where the operator needs one, a value.

4. To combine rules, select Add rule. The line above the rules decides whether all of them must match. The bin icon removes a rule.

A condition on the Additional details field

Form Settings

When no element is selected, for example when you first open a form, the right-hand column shows Form settings:

• FORM DETAILS: the Title and Description shown at the top of the form, and the Submit button label;

• SUCCESS MESSAGE: the Success title and Success message shown after someone submits.

A template fills these in for you. For example, the Phishing Report template uses the title Phishing Report and the success title Response submitted.

Previewing a Form

Select Show Preview to try the form the way the person filling it in will: required fields, patterns and conditions all behave as they will on the live form. Close the preview with the × button. A preview is never submitted, so you can try it as often as you like.

The preview before the rule matches

The preview after the rule matches

Publishing a Form

Publishing makes the form available and decides what happens with each submission: which sites the form serves, which classic playbook runs, which incident type is created, and who may open the form.

1. In the builder, select Publish.

2. In Publish — set up the link, choose the Sites the form is published to. You can select several sites, or Select All.

3. Choose the Classic playbook that runs for each submission and the Incident type of the incident it creates. These lists show what is available on the selected site, so choose the site first. Owner is optional.

4. Choose the Access mode (see the table below).

5. Choose when the link expires: 24 hours, 7 days, 30 days, 90 days or Never expires. The window shows the date the link will stop working.

6. Tick Show in Portal to add a tile for the form to the Portal, where signed-in users can open it.

7. Select Create link & publish.

Publishing with a public link

Publishing with SSO required and a Portal tile

A published form in the builder

The published form in the Forms list

Changing the Link Settings

Select Link in the builder of a published form to see and change how it is published. Form links lists one link per site; each link stays the same when you publish a new version.

The Link settings window

• Sites shows where the form is Currently live. Select Unpublish next to a site to stop that link serving. Submissions already received are kept.

• Classic playbook, Incident type, Owner, Access mode and Show in Portal work as they do when publishing. Link expires is Leave unchanged unless you pick a new period.

• Select Save link settings to apply your changes, or close the window to leave them as they are.

Mapping Answers to Incident Fields

Each submission creates an incident. Mapping decides which answers land on which incident fields, so the incident is ready to work on without anyone copying answers across. Answers you do not map still reach the incident as raw data.

Select Mapping in the builder of a published form to open Answers on the incident.

The Answers on the incident window

• Each row is one question, with its type (for example EMAIL, SHORTTEXT, BOOLEAN, LONGTEXT or DATE). Under GOES TO, choose the incident field it fills, or leave it not mapped.

• The summary line counts the questions, how many are mapped, and how many have a suggestion, such as Email subject → Title and Additional details → Description.

• Select Save mapping to keep your choices. How this works opens the rules in full.

What each incident field accepts:

The incident type and the owner always come from the link settings, never from an answer, so someone filling in the form cannot reroute or reassign the incident. Uploaded files need no mapping: they are attached to the incident automatically.

The Portal

The Portal is a self-service page where signed-in users find the forms shared with them and keep track of what they have submitted, without needing a link for each form.

The Portal

• Site chooses which site's portal you are looking at.

• AVAILABLE FORMS shows a tile for every form published to that site with Show in Portal ticked. When there are none, the Portal says No forms available yet.

• COMPLETED FORMS lists submitted forms with their status. Mine shows your own submissions; Everyone shows submissions from anyone on this portal.

Portal Settings

The Portal settings tab sets what each portal shows the people who use it, and gives you its link.

The Portal settings tab

Select Save portal settings to apply your changes.

Deleting a Form

Delete a form you no longer need to remove it from the list and the Portal.

1. On the Forms tab, find the form and select the Delete icon in Actions.

2. In Delete form, select Delete.

The Delete form window

Related Articles

• Investigation Playbooks

• Incident Type Manager

• Incident Workspace