[DemistoClassApiModule] Why CustomFields in demisto.incident()

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

[DemistoClassApiModule] Why CustomFields in demisto.incident()

L3 Networker

Why is there a separate dictionary returned from demisto.incident? Does it matter whether a field is custom or builtin


I am asking this because I am thinking about implementing a custom function in CommonUserPython to grab field values without worrying about if the field is custom or built-in. Would this implementation cause any trouble?


L3 Networker

Hey @EnesOzdemir ,


you could set all the details you want to a custom key of your choosing by using the !Set command. Afterwards you can use the 

"demisto.get(demisto.context(), 'key_name')"

As long as the details you want are in the Context Data you can always access what you need. Use the Try and Except flow to catch errors yet you can test that the field exists and is not empty with other built-in tools. 

In regards to the main difference between custom fields and incident fields I cant provide you with an exact difference between them in regards to CommonUserPython. 


  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!