topic Re: Search custom fields in report query in Cortex XSOAR Discussions

Search custom fields in report query

MKececioglu — Tue, 19 Jul 2022 08:38:14 GMT

Hi,

I think subject is clear enough that what i want to 🙂 , for some reason i want to query on some custom fields in report query page. As below pictures presents "domain" is the custom field that i need to query but no way to call it in report query page.

Changing mapper and map to a searchable filed is a workaround but i need to query exactly based on custom field.

Re: Search custom fields in report query

nkazinets — Tue, 19 Jul 2022 10:54:09 GMT

Hey @MKececioglu,

Can you try using this custom field in other places, like running setIncident from the CLI or querying it on the incidents page?
There is a bug in some builds of 6.6, where this issue would occur - not seeing custom fields specifically in widgets. I don't see it reproduce in 6.8 and in latest versions of 6.6 so it seems fixed.

Note that even though you don't see the field as an option, if you type its' full machine name and then add the colon sign ':' you will be able to use it - the issue is just with having it pop up for auto-completion.

Re: Search custom fields in report query

pdugan — Mon, 13 Feb 2023 17:44:40 GMT

If you want the dropdown to autopopulate the custom fields, type "incident." then select the custom field.