Select All in Data Collection multi select

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Select All in Data Collection multi select

L2 Linker

Hi!

 

We have a playbook which extracts indicators and adds it to a certain watchlist. In between, we allow user to select which indicators should be added by using Data Collection - Multi select / Array reply option. It is quite problematic slecting it manually when the selection is large, e.g. 100 entries. Is there a way to add a "Select all" button here, or "pre select" items before presenting to user? Maybe using data collection templates?  It is not all or nothing situation as sometimes user may needs to select e.g. 98 entries out of 100. Any ideas? We're on 6.6 version btw.

 

Thanks,

Antanas

Curious Fellow
1 accepted solution

Accepted Solutions

L3 Networker

Hello! I tried finding an option for you to select all but it seems we don't offer that. Another way you could get around this is to make all the options shown to the user and just have them input the few ones that need to be taken action on and you can just parse the response, that way the user is not sitting there clicking endlessly and instead just to have to copy/paste a few values. 

 

So basically all the options are part of the question and the response would be a short text that the playbook parses. Let me know if this helps!

View solution in original post

3 REPLIES 3

L3 Networker

Hello! I tried finding an option for you to select all but it seems we don't offer that. Another way you could get around this is to make all the options shown to the user and just have them input the few ones that need to be taken action on and you can just parse the response, that way the user is not sitting there clicking endlessly and instead just to have to copy/paste a few values. 

 

So basically all the options are part of the question and the response would be a short text that the playbook parses. Let me know if this helps!

L0 Member

Hello,

 

I know this is a late response. I was looking for a similar outcome as mentioned above. I do have separate multi-select/arrays for the different IOCs grouped. What did you mean by "a short text that the playbook parses"? Could you give an example? 

Is there a way to reverse this and rather than select individual IOCs to be included. Select only ones that are excluded from being ingested to XDR or other platforms? 

 

Thanks!

L3 Networker

Hi,

'By a short text that the playbook parses' I meant that you can create a field of type short text and have the analysts input all the IOCs at once instead of having them click endlessly. So go to Settings > Objects Setup > Fields > New Field of type short text. Please review this video if you need further information: https://www.youtube.com/watch?v=o92rG4FPc-k&list=PLD6FJ8WNiIqUVEA2e5LZhmqNnwFcFhDTZ&index=2

 

When it comes to what you do with that data it depends on what is needed so you could extract the field information and send over everything else for ingestion.

  • 1 accepted solution
  • 1604 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!