Fields

The Fields section lists all the possible fields available for the wizard or incidents.

The application provides a number of fields. Most fields are self-explanatory. The following list provides a description of a few of the fields.

Department. You can specify a custom internal department name within your organization that might be involved in a data exposure.
Exposure Source/Vendor. You can specify a custom name for a vendor or other third party to your organization that might be involved in a data exposure.
Last Modified. Tracks the time of the last change to an incident. It is a read-only field that can be used in filters and layouts, and displayed in the incident list. It cannot be used in rules or other conditions.
Source of Data. You can specify a custom source of data loss, such as a specific name of a database or business application. This information becomes useful when you analyze trends.
Sequence Code. The field includes a prefix and index that increments for each new incident that is created in the account. The sequence code is included in reports and the audit log. Unlike other fields, users cannot edit the field value in an incident. You can modify the prefix in the Administrator Settings.

You can edit each field to customize it to your own needs. To use a field in your incident, drag it to a location in the Incident column.

In addition, you can create new data fields for tracking, reporting, and documentation purposes.

To create a custom field, click Add Field and enter the parameters. The following example shows a JSON field type.

To create a custom field, click Add Field and enter the parameters.

When you add a field, you can configure it as follows.

If the Label for the field is more than 80 characters, an Abbreviated label property is shown. It allows designers to provide a long name or instructions for users but a shorter name for designers and programmers. The API name is then derived from the Abbreviated label instead of the label for the field. By default, the abbreviated label is the first 80 characters of the field label. The text in the Abbreviated label is not shown to users.
If the user is not required to complete the field, mark it as Optional.
Use Always to make it a required field when opening an incident. When a user creates a new incident, fields marked as Always show up with an asterisk in the user interface, which indicates it is required.
Use On Close to make it required when closing an incident. When a user closes an incident, the system prompts the user with a dialog that displays any fields marked On Close but have not yet been set.

When creating a field of the type Select, you can set a default value. The value is shown only if it exists in the new incident wizard or anywhere else in the layout.

When creating a field of the type JSON, you can set an optional JSON schema value.

When creating a field of the type Multiselect, you can set a default value; however, the default value is relevant only for the new incident wizard. When the field is used in other places, the default value is not shown.

You cannot delete a value in an existing Select or Multiselect field if it is used in a running playbook, rule, or workflow. However, playbooks, rules, and workflows that were created before IBM Security QRadar Suite V1.9 and not saved since then are not checked.

When you create or edit a field of the type Select or Boolean, you can track the duration that the field spends on each value by selecting Track change times. You can use the tracking information in custom graphs or in an incident tab where the Timers Widget view is added. For more information, see Custom graphs, or Displaying time tracking information in a tab.