Notifications
Clear all
Topic starter
01/08/2026 6:15 am
Okay, this might be obvious to everyone else, but I just had a small revelation while poking around our Cortex XDR instance. 😅
You can actually set up custom incident layouts for different analyst roles. So our L1 folks can see a simplified view with just the priority stuff, while the threat hunters get all the deep forensic fields right up front. It seems like such a simple thing, but it's going to save my team so much scrolling and confusion. Does anyone else use this? I'd love to hear how you've structured yours—maybe I can steal some ideas!