Hi Peter, Why are there two customer CF? it is mainly because the CF in IR queue could store multiple values, and in Investigations queue just one. I think you could disable one of them, and then the other one enabled in both queues.
Cheers, Carlos On 13 Nov 2013, at 17:48, Peter Bates <[email protected]> wrote: > Signed PGP part > > Hello all > > On 13/11/2013 16:07, Kevin Falcone wrote: > > Either pre-populate it or change it to a freeform field, although that > > may act weirdly with the built in reporting. Try it and see. > > Tools -> Configuration -> Custom Fields > > I'll give this a go - Custom Fields shows that there are two > 'Customer' fields, one is 'Select multiple values' (for the IR queue) and the > other is 'Select one value' (for the Investigations queue). > > Is it not possible to just have one if I'm going to try > and populate a list? > > Apologies for this - I'll read the workflow document again. > The majority of our work here is manual response to IDS alerts > from which we throw an Incident and then into an Investigation. > > -- > Peter Bates > Senior Information Security Officer Phone: +44(0)2076792049 > Information Services Division Internal Ext: 32049 > University College London > London WC1E 6BT > >
signature.asc
Description: Message signed with OpenPGP using GPGMail
