topic Re: Select All in Data Collection multi select in Cortex XSOAR Discussions

Select All in Data Collection multi select

Antanas — Mon, 12 Sep 2022 11:33:03 GMT

Hi!

We have a playbook which extracts indicators and adds it to a certain watchlist. In between, we allow user to select which indicators should be added by using Data Collection - Multi select / Array reply option. It is quite problematic slecting it manually when the selection is large, e.g. 100 entries. Is there a way to add a "Select all" button here, or "pre select" items before presenting to user? Maybe using data collection templates? It is not all or nothing situation as sometimes user may needs to select e.g. 98 entries out of 100. Any ideas? We're on 6.6 version btw.

Thanks,

Antanas

Re: Select All in Data Collection multi select

Ivetto — Thu, 02 Feb 2023 20:43:51 GMT

Hello! I tried finding an option for you to select all but it seems we don't offer that. Another way you could get around this is to make all the options shown to the user and just have them input the few ones that need to be taken action on and you can just parse the response, that way the user is not sitting there clicking endlessly and instead just to have to copy/paste a few values.

So basically all the options are part of the question and the response would be a short text that the playbook parses. Let me know if this helps!

Re: Select All in Data Collection multi select

amahmoud_IDA — Thu, 04 Apr 2024 17:33:48 GMT

Hello,

I know this is a late response. I was looking for a similar outcome as mentioned above. I do have separate multi-select/arrays for the different IOCs grouped. What did you mean by "a short text that the playbook parses"? Could you give an example?

Is there a way to reverse this and rather than select individual IOCs to be included. Select only ones that are excluded from being ingested to XDR or other platforms?

Thanks!

Re: Select All in Data Collection multi select

Ivetto — Fri, 05 Apr 2024 14:22:53 GMT

Hi,

'By a short text that the playbook parses' I meant that you can create a field of type short text and have the analysts input all the IOCs at once instead of having them click endlessly. So go to Settings > Objects Setup > Fields > New Field of type short text. Please review this video if you need further information: https://www.youtube.com/watch?v=o92rG4FPc-k&list=PLD6FJ8WNiIqUVEA2e5LZhmqNnwFcFhDTZ&index=2

When it comes to what you do with that data it depends on what is needed so you could extract the field information and send over everything else for ingestion.