This is not currently possible out of the box. I think this can be done with a script. There are two options in this way:
1) Create a rule for each field which has conditions that check to see if the field is set when required. If not run a script that uses helper.fail to provide an error message that is useful for the user.
2) Create a rule that always runs a single script. The script has "if" blocks that checks each field is set when required and if not, then use helper.fail to provide an error message that is useful for the user.
Here is a very simple example of a script that does something like this:
if task.at_id == 'determine_if_inappropriate_internal_involvement': if incident.employee_involved is None: helper.fail("'Employee Involved' field must be set to Yes or No") Ben
------------------------------
Ben Lurie
------------------------------
Original Message:
Sent: Mon June 08, 2020 05:05 PM
From: Jason Jemmott
Subject: Incident field visible only on certain incident types
So for the $10M answer - can you set the requirement of these fields to Always and still have them only be visible and required when they meet the criteria specified in the Section block?
------------------------------
Jason Jemmott
Cyber Security Analyst
------------------------------
Original Message:
Sent: Fri June 05, 2020 11:03 AM
From: Jared Fagel
Subject: Incident field visible only on certain incident types
Hey @Jason Jemmott,
I couldn't find anything on layouts unfortunately, other than the really basic KnowledgeCenter blurb:
https://www.ibm.com/support/knowledgecenter/en/SSBRUQ_37.0.0/doc/playbook/resilient_playbook_configlayouts_blocks.html
Best,
------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
Original Message:
Sent: Fri June 05, 2020 09:41 AM
From: Jason Jemmott
Subject: Incident field visible only on certain incident types
Thanks Jared! This worked perfectly, now I can have my workflows trigger off the value of this field :) - I've never used the blocks section before, is there a particular piece of e-literature or a good video lecture on securitylearningacademy.com that may help me with better understanding the usage of the other Blocks?
------------------------------
Jason Jemmott
Cyber Security Analyst
Original Message:
Sent: Thu June 04, 2020 10:50 PM
From: Jared Fagel
Subject: Incident field visible only on certain incident types
Hey @Jason Jemmott,
Yes, you can!
Here's how:
- Go the the Layouts section under "Customization Settings" and locate the layout you want this in.
- Create your "Malware Delivery Method" field as you wish (start by clicking "Add Field").
- Add your new "Malware Delivery Method" field to the layout wherever you wish it to go.
- On the right side at the very bottom you'll see the "Blocks" section, add a "Section" block.
- Slide/move the "Section" block above/below where you placed the "Malware Delivery Method" field.
- Slide/move the "Malware Delivery Method" field inside the section block you added.
- Edit the "Section" block - Add condition of "Incident Type" and select "is equal to" "Malware"
- Save your layout.
- It will now show when the incident type changes or has been selected within the editor.
Cheers!
------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility