Hello Leo,
after some revision, i had sth different in mind.
You're referring to the default "open incidents by phase" widget, which cannot be adjusted. We have the same "error".
It does however trigger when you adjust the default field e.g. " was personal information pr personal data involved" to yes -- > in the breach section i do see a new case then. ( searched for similarities among the few amount of cases which actually do show up out of all test cases; they all have " breach" in common)
Meaning this widget only works with certain default fields. (stays true in v43)
Hope this helps.
Best
Robert
------------------------------
Robert Doerge
------------------------------
Original Message:
Sent: Tue February 08, 2022 07:10 AM
From: Leonardo Kenji Shikida
Subject: Analytics Dashboard - Open Incidents By Phase
Hi Robert
I've removed all filters from the dashboard and it still shows only zeroes for all incidents x phases.
The widget itself ("Open Incidents by Phase") does not have any parameter customization available.
However, the "Phase" pie chart widget and the "Time in Phase by Incident Type" widgets are showing the correct data.
My feeling is that the "Open Incidents by Phase" treats the phase info in a different way, which is IMO, just broken.
------------------------------
[]
Leonardo Kenji Shikida
Original Message:
Sent: Tue February 08, 2022 04:18 AM
From: Robert Doerge
Subject: Analytics Dashboard - Open Incidents By Phase
Hello Leo,
Due to the revised layout in 42, we faced similar issues when switching from 41 to 42. The remedy was to go over the filters again. global dashboard filter vs widget filter vs incident board filter.
Best
Robert
------------------------------
Robert Doerge
Original Message:
Sent: Fri February 04, 2022 07:25 AM
From: Leonardo Kenji Shikida
Subject: Analytics Dashboard - Open Incidents By Phase
I have a doubt about this widget.
I have a workflow that goes like this
In the incidents list, each incident shows the correct phase and status.
However, in the dashboard, in the "open incidents by phase", all values are zero.
Is it the expected behavior? I was expecting to have the same information I have in the incident list.
I am using SOAR 42.2.41
TIA
Leo
------------------------------
[]
Leonardo Kenji Shikida
------------------------------
