IBM Security QRadar SOAR

Hello,

USE CASE: Based on a use case, I have created a custom initial triage task, within it as a layout, I also created a custom field (select) to include time choices (in minutes) for analyst to choose in order to get the value and search logs in Qradar based on that time range.

ISSUE: Once I create the custom field, it's not showing in the custom initial triage task so that the analyst choose a timestamp.

Screenshots:

In the screenshots I also tried with multiselect custom field and it's not showing anything in the layout.

I appreciate your support and suggestions regarding this matter,

Thank you,

Hi Ben 

Can you also post your rule here ...

The rule determines when you custom task is included in the incident type and incident area.

I had the same issue as you until I add the custom task to a rule  and associate it with the incident type under rule conditions

Hello,

USE CASE: Based on a use case, I have created a custom initial triage task, within it as a layout, I also created a custom field (select) to include time choices (in minutes) for analyst to choose in order to get the value and search logs in Qradar based on that time range.

ISSUE: Once I create the custom field, it's not showing in the custom initial triage task so that the analyst choose a timestamp.

Screenshots:

In the screenshots I also tried with multiselect custom field and it's not showing anything in the layout.

I appreciate your support and suggestions regarding this matter,

Thank you,

I am able to multiselect on that custom field .... within that custom task once I am in edit mode ( and only edit mode)

Hi Ben 

Can you also post your rule here ...

The rule determines when you custom task is included in the incident type and incident area.

I had the same issue as you until I add the custom task to a rule  and associate it with the incident type under rule conditions

Hello,

USE CASE: Based on a use case, I have created a custom initial triage task, within it as a layout, I also created a custom field (select) to include time choices (in minutes) for analyst to choose in order to get the value and search logs in Qradar based on that time range.

ISSUE: Once I create the custom field, it's not showing in the custom initial triage task so that the analyst choose a timestamp.

Screenshots:

In the screenshots I also tried with multiselect custom field and it's not showing anything in the layout.

I appreciate your support and suggestions regarding this matter,

Thank you,

Hello,

USE CASE: Based on a use case, I have created a custom initial triage task, within it as a layout, I also created a custom field (select) to include time choices (in minutes) for analyst to choose in order to get the value and search logs in Qradar based on that time range.

ISSUE: Once I create the custom field, it's not showing in the custom initial triage task so that the analyst choose a timestamp.

Screenshots:

In the screenshots I also tried with multiselect custom field and it's not showing anything in the layout.

I appreciate your support and suggestions regarding this matter,

Thank you,

Hello Sha Ben,

Thank you for reaching out and your question. You would need to click on Edit button on top right corner of task details page to be able to edit the fields. I just tried and it works. 

Thanks

Hello,

USE CASE: Based on a use case, I have created a custom initial triage task, within it as a layout, I also created a custom field (select) to include time choices (in minutes) for analyst to choose in order to get the value and search logs in Qradar based on that time range.

ISSUE: Once I create the custom field, it's not showing in the custom initial triage task so that the analyst choose a timestamp.

Screenshots:

In the screenshots I also tried with multiselect custom field and it's not showing anything in the layout.

I appreciate your support and suggestions regarding this matter,

Thank you,