Skip to main content
Skip table of contents

Configuring an Incident Type: Incident Form Builder

LAST UPDATED: JULY 15, 2025

Overview

The Incident Form Builder allows users to create forms for manually capturing incident details within the incident workspace. Each incident type supports one form, structured with a root node linked to one or more section nodes. Section nodes contain activity and info activity nodes, where users configure the form inputs.

Group 8 (3).png
Filling Out the Incident Form During an Investigation

Users can fill out the incident form within the incident workspace when the active workspace layout includes the Incident Form widget.

Group 9.png

Creating an Incident Form

To create an incident form, navigate to the Incident Form Builder tab.

Group 35 (1).png

The Incident Form Builder includes the following components:

Group 11 (1).png

  • Add New Form Items: Provides options for users to add new section, activity, and info activity nodes to the incident form.

    1.png

    • All sections must be connected to the root node.

      rootnode.png

  • Reusable Form Items: Enables users to drag and drop section, activity, and info activity nodes created previously. All section, activity, and info activity nodes added to the editing canvas automatically become reusable form items.

    Group 36.png

  • Editing Canvas: Serves as the workspace where users configure the form’s section, activity, and info activity nodes.

    Group 1 (9).png

Adding a Section Node

Group 4 (1).png

An incident type form must include at least one section node. Each section node acts as a container for activity and info activity nodes, grouping related form fields for structured data collection.

To add a section node, drag a Section form item to the root node.

Frame 4 (1).png

Users can assign a more descriptive name to the section node in the configuration popup.

Group 13.png
Use as Data Source in Reporting Module

To use inputs from activity and info activity nodes as query fields in a Reporting Dashboard widget, see the example below.

  1. Select the Use as data source in reporting module checkbox.

    Group 46.png

  2. Ensure that the incident form contains data.

    Group 47.png

  3. Navigate to Reporting Dashboard > Widgets, then click the + New button.

    Group 48.png

  4. Select Incident as the Data Source, a site, and a date range.

    Group 49.png

  5. Click the + Field button, then choose the incident form field to use as a filter for the queried data.

    Group 50 (2).png

  6. Continue with the rest of the Reporting Dashboard widget configuration.

When a form contains multiple section nodes, users can reorder them by clicking the Change Sections' Order button, dragging a row to the desired position, and clicking the Done button.

Group 7 (1).png

Adding an Activity Node

Group 12 (1).png

Activity nodes are form field types that provide predefined input options, such as checkboxes, dropdown menus, and radio buttons, enabling users to select from specified choices.

To add an activity node, drag an Activity form item to a section node.

Frame 5 (1).png

In the configuration popup window, enter the activity name and select its type. For all available activity types, expand the accordion below.

Group 14 (1).png
All Available Activity Types

All available activity types are listed below:

Group 37.png

  1. Check Box: Enables users to check one or more boxes.

  2. Drop-down Menu: Enables users to select a single option from a dropdown list.

  3. List Box: Enables users to select a single row from a list.

  4. Radio Buttons: Enables users to select a single option from a set of radio buttons.

  5. Radio Buttons Read-Only: Displays radio button options in a read-only format.

Users can populate read-only fields using utility commands.

After selecting a type, click the Next button, then the Add Option button to add activity options.

Group 17 (1).png
Group 18 (2).png

In the next page, enter the option name, then click the Next button. Option names must be unique and are case insensitive.

When multiple options are configured, users can reorder them by selecting the activity node and clicking the Change Options' Order button.

Group 19 (1).png

Adding an Info Activity Node

Group 20 (1).png

Info activity nodes are form field types that allow users to enter information freely using inputs such as text boxes and number boxes.

To add an info activity node, drag an Info Activity form item to a section node.

Frame 6.png

In the configuration popup window, enter the info activity name, select its type, then click the Next button to add the info activity. For all available info activity types, expand the accordion below.

Group 21 (1).png
All Available Info Activities

All available info activity types are listed below:

Group 41.png

  1. Button Control: Allows users to create and switch between multiple instances of the incident form section.

    Group 42.png

    1. Click the New Instance button to create another instance of the section.

    2. Click the Clear Instance button to clear the contents of the current instance.

    3. Click the Delete button to permanently remove the current instance.

    Different form instances are distinguished by the section name followed by a number (e.g., Demo Section All Info Activity Nodes 1 and 2).

    Group 43.png

  2. Calendar and Time Control: Enables users to enter a date and time.

  3. Calendar Control: Enables users to enter a date.

  4. Divider Header: Allows users to insert a divider in the form.

  5. Email Text Box: Allows users to enter an email address validated by regex.

  6. JSON Table: Allows users to create a table using JSON data.

  7. JSON Table Read-Only: Allows users to view a preconfigured JSON table without editing.

  8. Numeric Text Box: Allows users to enter numeric values only.

  9. Text Area: Allows users to enter multiple lines of text using a text or HTML editor.

  10. Text Area Read-Only: Allows users to view a preconfigured multi-line text value without editing.

  11. Text Box: Allows users to enter a single line of text using a text or HTML editor.

  12. Text Box Read-Only: Allows users to view a preconfigured single-line text value without editing.

  13. Time Control: Enables users to enter a time.

Users can populate read-only fields using utility commands.

Additional Information on Activity and Info Activity Nodes

Rearranging Nodes

Users can rearrange activity and info activity nodes as needed within the form layout:

  1. Select the parent section node.

  2. Click the Change Activities' Order button.

  3. Drag each activity to the desired position.

  4. Click the Done button.

    Frame 7.png

Renaming Node Options

To rename options for input types like checkboxes and drop-down menus, select the option within the node, enter the new name, and click the Group 45.png button to apply the change.

Group 44.png

Active Setting

Group 25.png

The Active checkbox determines whether the form field is visible in the incident form within the incident workspace. By default, nodes are active. Users can uncheck this checkbox to make the node inactive.

Required Setting

Group 26.png

The Required checkbox, when checked, ensures that the activity or info activity must be completed before saving the form, as long as other form fields contain data.

Required on Close Setting

Group 27.png

The Required on Close checkbox, when checked, ensures the activity or info activity must be completed before closing an incident.

Setting Incident Field Values with Utility Commands

The following commands enable users to set or update incident fields to support automation and to populate read-only fields:

Group 28.png

READER NOTE

Other utility commands available for retrieving or modifying incident form data include:

For additional details, refer to the respective utility command pages.

This demonstration uses the Set Incident Dynamic Field Values command. To follow along, complete the following steps within an investigation playbook:

  1. Add a Set Incident Dynamic Field Values utility command task.

    Group 30.png

  2. Configure the input parameters:

    Group 31.png

    1. Enter the exact name of the section.

      This can be a dynamic value as well (i.e., $.DataSource.incident["Dynamic fields"][*].sectionName).

    2. Defines filters for form instances within the specified section using key-value conditions. Incident field values will be set only when these conditions are met.

      The example specifies that the new field values will be set only if the Email Sender field is secure-access-login@off1ce365.verify-now.unknown-domain.ru.

    3. Input the key-value pairs (in JSON format) to update the incident form.

      The example indicates that the Confirmed Malicious Sender field value should be set to Yes.

  3. Set this task to Auto Run, then click the command node checkmark.png button to save.

    Group 32.png

  4. Submit and publish the playbook to the desired sites.

When the configured investigation playbook is associated with an incident, the incident form will be updated according to the settings defined in the Set Incident Dynamic Field Values utility command.

Before the configured investigation playbook ran

Group 33.png

After the configured investigation playbook ran

Group 34.png
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close