End-of-Life (EoL)

Create Dynamic Fields in Incident Forms

You can control which fields display in an incident form, and which values display for single-select and multi-select fields. The scripts support JavaScript and Python.
This can be useful in the following scenarios:
  • You want to have certain values appear in a certain field when the value of another field is
    a
    or
    b
    .
    For example, if the value in the
    Owner
    field is Admin, the values in the assignee field should be
    Jane
    ,
    Joe
    , or
    Bob
    . However, if the value in the
    Owner
    field is anything else, the values in the assignee field should be
    Mark
    ,
    Jack
    , or
    Christine
    .
  • You want a field to be available in a form only in certain conditions.
    For example, if the value in the
    Severity
    field is
    High
    or
    Critical
    , the
    Escalate
    field should be available with values of
    Yes
    or
    No
    .
    However, if the value in the Severity field is
    Low
    or
    Informational
    , the
    Escalate
    field should not appear.
  1. Navigate to the
    Automation
    page and duplicate the hideFieldsOnNewIncident automation.
    1. Give the script a descriptive name.
    2. Enter a useful description.
    3. Under
      Tags
      , make sure that the
      field-display
      tag appears.
      This tag must be applied for the script to be available to be used on the field.
    4. Save the automation.
  2. Write the automation script.
    This can be done either in the script window to the left, or in the script settings on the right. Review the examples at the end of this section for more information.
  3. Add the script to the relevant field.
    1. Navigate to
      Settings
      Advanced
      Fields
      .
    2. Click
      +New Field
      to create a field, or select the existing field to which you want to add the script and click
      Edit
      .
    3. Under
      Field Type
      , select the field type. For example, Single select.
    4. Under
      Field Name
      , enter a descriptive name.
    5. Under the
      Attributes
      tab, in the
      Field display script
      field, select the script you want to run on this field.
    6. Complete the remaining field-definitions and click
      Save
      .
  4. Implement the
    Assign To
    field in the relevant layouts. For more information, see Customize an Incident Type Layout.
Example - Change Field Values Dynamically
The following example shows how you would create a script for the Assignee field, which shows different values depending on the values in the
Owner
field. If the Owner is defined as ‘admin’, the list of available assignees will include one group of people. If the Owner is defined as anything else, the list of available assignees will include a different group of people.
  1. In the
    Automations
    page, we copy the
    hideFieldsOnNewIncident
    and name it
    changeAsigneesPerOwner
    .
  2. In the
    Description
    field, we enter the following:
    Changes values available in the Assignees field based on the person defined as the owner.
  3. Under
    Tags
    , let’s add the
    field-display
    tag.
  4. For the automation, we enter the following code:
    incident = demisto.incidents()[0] field = demisto.args()['field'] if incident.get('owner') == 'admin': demisto.results({'hidden': False, 'options': ['jane','joe', 'bob']}) else: demisto.results({'hidden': False, 'options': ['mark','jack', 'christine']})
    where
    • demisto.incidents is the incident in which this script is running.
    • incident.get(‘owner’) is the field within the incident.
    • demisto.results tells us whether to hide the field or not, and which values should appear in the field. When the owner is admin, the values will be Jane, Joe, and Bob. When the owner is anyone else, the values will be Mark, Jack, and Christine.
  5. We navigate to
    Settings
    Advanced
    Fields
    and click
    +New Field
    .
    • We’ll call the field
      Assign To:
      .
      The
      Values
      field in the
      Basic Settings
      tab has been left blank because we hard-coded the values in our script.
    • Under the
      Attributes
      tab, in the
      Field display script
      field, select the
      changeAsigneesPerOwner
      script we created above.
    • Fill in the rest of the field definitions as desired and click
      Save
      .
  6. We have to implement the field in an incident layout. For our example, we’ll use the Authentication incident type.
  7. Lastly, we create an incident and see what happens when the Owner is set to Admin and when the Owner is set to anything else.
Example - Hide Field based on Context
In this example, we'll show how to hide a field for a new incident form, but display the field when editing the form. We'll also set field values for a multi-select field in the case of an existing incident.
For this example, we use the
hideFieldsOnNewIncident
out-of-the-box automation.
incident = demisto.incidents()[0] field = demisto.args()['field'] formType = demisto.args()['formType'] if incident["id"] == "": # This is a new incident, hide the field demisto.results({"hidden": True, "options": []}) else: # This is an existing incident, we want to show the field, to know which values to display options = [] # The field type includes the word select, such as Single select or Multi select if "Select" in demisto.get(field, "type"): # take the options from the field definition options = demisto.get(field, "selectValues") demisto.results({"hidden": False, "options": options})
  1. We navigate to
    Settings
    Advanced
    Fields
    .
  2. Select the
    Malicious Cause
    field and click
    Edit
    .
  3. Under the
    Field display script
    field, select the
    hideFieldsOnNewIncident
    script and click
    Save
    .
  4. Navigate to the
    Incidents
    page and click
    New Incident
    .
  5. Under the
    Type
    field, select
    GDPR Data Breach.
    Scroll down and note that under
    Mandatory Information
    , there is no
    Malicious Cause
    field.
  6. Click
    Create New Incident
    to save the incident.
  7. Select the incident you just created and click
    Edit
    .
    Scroll down to the
    Mandatory Information
    section and note that the
    Malicious Cause
    field appears and the options for the field are retrieved from the initial field definition.

Recommended For You