Skip to main content

Cyware Fusion and Threat Response

Manage Field Library

The field library is a repository of various types of fields that you can use to configure the phases of an incident workflow. The field library includes the out-of-the-box fields and the custom fields.

When creating or editing an incident workflow, you can view all the fields. With the Field Library, you can do the following:

  • Access all incident fields to reuse them in incident workflows.

  • Identify the fields that are used in the current incident workflow. The greyed-out fields indicate that the field is used in the current incident workflow.

  • Expand the field dropdown to view the phase in which the field is added.

Create Field

When creating or updating a phase, you can create custom fields to add to the phase.

Note

You can create up to 2000 fields including Character, Integer, Date-Time, Single-select, and Multi-select.

This feature is available in v3.3.5.5 onwards.

To create a field, follow these steps:

  1. Go to Admin > Form Management > Incidents.

  2. Select an incident workflow and click Edit.

  3. In Field Library on the right, click New Field.

  4. Enter the following details:

    • Name: Enter a name for the field.

    • Field Type: Select a field type from the list. You can select from options such as Text Field, Expandable Text Field, Text Area, Single Select, Multi Select, Integer, and Date.

    • Add Options: If you select the field type as Single Select or Multi Select, enter the option names. Click Add New to create an option.

    • Mandatory Field: Select this option to mark the field as mandatory. Analysts must enter the mandatory fields to create or close an incident.

    • One-Time Entry Field: Select this option to mark the field as a one-time entry. Analysts cannot update a one-time entry field after they have entered it for the first time.

    • Show in Dashboard/Report Widgets: If the Field Type is Single Select or Multi Select, select this option to display the field in the Dashboards and Reports.

    • Show in Filters: If the Field Type is Single Select or Multi Select, select this option to display the field in the incidents listing page filters.

    • Restrict field access by User Group: Select this option and select the user groups to provide edit access to specific user groups. Other user groups can view but cannot modify the field.

    • Request Notes: If the Field Type is Single Select, select this option to request analysts to enter the reason for updating the field value after the incident is created. Without providing a reason, analysts cannot update the field value.

      Note

      Analysts can view the reason entered in the incident Notes.

    • Help Text: Enter a description for the field. This description will appear as a help text in the incident creation form.

    • Readable Key: View the readable key for the field and field value. A unique Readable Key is automatically assigned to the newly created fields. The Readable Key is used to obtain field values using the REST API method. The supported format is JSON.

  5. Click Add. The field that is created will appear at the top of the Field Library.

For more information on some frequently asked questions about the field library, see Incident Workflows FAQs.

Configure Conditional Logic of Field

After adding a field to the field library, you can edit the field and configure the conditional logic. Using conditional logic, you can show or hide a field, make the field read-only, and define the options to be displayed for the fields while creating or updating incidents. For more information, see Configure Conditional Logic of Field.

Supported Activities for Field Library

You can perform the following activities to manage the field library:

  • Search or filter fields using the field name.

  • View activity logs to track updates to the fields. You can also search or filter activity logs based on action, created date, and user. Additionally, you can export activity logs in PDF format.

  • Edit fields to update the details, such as the name, options, help text, readable key, conditional logic, and more. After you update a field, the updates are reflected in all existing incidents.

    Note

    You cannot update the field type of a field.

  • Delete fields from the field library. You cannot delete a field that is used as the controlling field in the conditional logic of another field. To delete the field, you must first remove it from the conditional logic of all fields.

    Note

    After you delete a field from the field library, the field is removed from all incident workflows, and the workflows are updated automatically.