IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

incident.incident_type_ids blanking the list when manuall updated.

  • 1.  incident.incident_type_ids blanking the list when manuall updated.

    Posted Tue December 05, 2023 03:03 PM

    We have discovered, when trying to add an incident type to incident.incident_type_ids from the dropdown list, editing the field from a layout, that the field becomes blank.

    However, if we use append in a script, it works just fine.

    We are running Version: 50.2.42

    This had worked in previous versions. We have gone through our rulebase, and eliminated anything that touches that field.

    What should we check nex?



    ------------------------------
    William Attwooll
    IBM MSS XFTM Resilient Admin
    IBM
    CO
    ------------------------------


  • 2.  RE: incident.incident_type_ids blanking the list when manuall updated.

    Posted Thu December 07, 2023 08:27 AM

    Hi William, when you say  editing the field from a layout, that the field becomes blank, could you outline the steps.

    I have created the incident type but in layouts where did you edit ?

    Regards

    John



    ------------------------------
    John Quirke
    ------------------------------



  • 3.  RE: incident.incident_type_ids blanking the list when manuall updated.

    Posted Fri December 08, 2023 11:13 AM

    Here is the config. 

    We have 50 incident types:

    Here is the layout

    Here is a sample that was built using a script:

    (I had to use a different incident, because I accidentally saved the blank on the last one)

    This is the dropdown






    ------------------------------
    William Attwooll
    IBM MSS XFTM Resilient Admin
    IBM
    CO
    ------------------------------



  • 4.  RE: incident.incident_type_ids blanking the list when manuall updated.

    Posted Fri December 08, 2023 11:16 AM

    And when I choose something from that dropdown, it blanks everything even before saving:



    ------------------------------
    William Attwooll
    IBM MSS XFTM Resilient Admin
    IBM
    CO
    ------------------------------



  • 5.  RE: incident.incident_type_ids blanking the list when manuall updated.

    Posted Fri December 08, 2023 12:27 PM

    Hi William 

    trying to reproduce here on 50.0.9

    Do you have special permissions to manually edit the Incident Type dropdown fields to add new fields ?

    John



    ------------------------------
    John Quirke
    ------------------------------



  • 6.  RE: incident.incident_type_ids blanking the list when manuall updated.

    Posted Thu December 28, 2023 12:07 PM

    No. It seems to take incident types and then compile the multi-select. However, I do notice discrepanices.



    ------------------------------
    William Attwooll
    IBM MSS XFTM Resilient Admin
    IBM
    CO
    ------------------------------

    Attachment(s)

    txt
    incident types.txt   19 KB 1 version
    txt
    incident_type_ids.txt   812 B 1 version


  • 7.  RE: incident.incident_type_ids blanking the list when manuall updated.

    Posted Tue January 23, 2024 09:34 AM

    Hi, do you have any further information?



    ------------------------------
    William Attwooll
    IBM MSS XFTM Resilient Admin
    IBM
    CO
    ------------------------------



  • 8.  RE: incident.incident_type_ids blanking the list when manuall updated.

    Posted Wed January 24, 2024 08:05 AM

    Hi William,

    I have reached out to the wider team for support  ....someone should be in contact shortly .

    John



    ------------------------------
    John Quirke
    ------------------------------



  • 9.  RE: incident.incident_type_ids blanking the list when manuall updated.

    Posted Thu January 25, 2024 03:26 AM

    Hi William

    I will raise a ticket against our Core team here to insure the issue is addressed.

    Regards

    John



    ------------------------------
    John Quirke
    ------------------------------



  • 10.  RE: incident.incident_type_ids blanking the list when manuall updated.

    Posted Thu January 25, 2024 07:43 AM

    Hi William

    Can you expand on 'editing the field from a layout, that the field becomes blank'.

    I successfully added new incident types  to that field but I want to know your steps for editing the field in a layout that causes the field to blank.

    What is the edit that causes the issue ?

    In which view do you see the field blanked ? when you try and add it to a new incident or an edit existing incident.

    Sorry for the confusion...

    Regards

    John



    ------------------------------
    John Quirke
    ------------------------------



  • 11.  RE: incident.incident_type_ids blanking the list when manuall updated.

    Posted Thu January 25, 2024 08:25 AM

    Hi William 

    another consideration may be to upgrade your SOAR environment to 50.2.54  or to SOAR V51

    Regard

    John



    ------------------------------
    John Quirke
    ------------------------------