IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Unable To Change Field Type

    Posted Thu November 07, 2019 05:33 AM
      |   view attached
    Hello Everyone,

    We have added a customized field name "Sub-category" while adding we chose the field type as "Select". 
    Later on, we changed its field type as "Multiselect" from "Select" for some testing purposes. Now I want to revert it back to "Select" but unable to change it as I can not see other types in the drop-down menu.  Thinks it is locked (not sure). Can you please help me out find the solution? Screenshot attached.

    ------------------------------
    Amit Kumar
    ------------------------------


  • 2.  RE: Unable To Change Field Type

    Posted Thu November 07, 2019 11:32 AM
    This is a product defect it sounds like. You will want to report this to Resilient support here.

    After you report the inability to revert the field back, the solution will be to re-create the field (after deleting the current one) and set it as a "select" type.

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------



  • 3.  RE: Unable To Change Field Type

    Posted Thu November 07, 2019 12:19 PM
    Hi Jared,

    Thanks for the response!

    I tried that part in dev platform to re-create the field (after deleting the current one) and set it as a "select" type but the value of that field is empty in old cases which is not giving the proper solution. 

    ------------------------------
    Amit Kumar
    ------------------------------



  • 4.  RE: Unable To Change Field Type

    Posted Fri November 08, 2019 09:51 AM

    This is not a defect, this behaviour is as designed

    You can change from select -> multiselect because any associated data can be converted. The data for select field will convert to a single item chosen within the multiselect. No data would be lost, and so the conversion is allowed.

    However, the converse is not true - there would be no way to interpret the data of 2 chosen values back into the single select. Thus, allowing the conversion would potentially lose data, and so it is not allowed.

    The same is true of Number -> Text (because 3 can become "3"); but Text -> Number does not make sense because "abc" cannot have a numeric value.



    ------------------------------
    Marty James
    ------------------------------



  • 5.  RE: Unable To Change Field Type

    Posted Fri November 08, 2019 03:22 PM
    Thanks for that information Marty!

    ------------------------------
    Jared Fagel
    Cyber Security Analyst Intern
    Public Utility
    ------------------------------