Troubleshoot Closing Case Incident after Changing Field Type - Administrator Guide - 6.6 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.6
Creation date
2022-09-29
Last date published
2024-07-30
End_of_Life
EoL
Category
Administrator Guide
Abstract

If you delete a grid field and then create a new field of another type with the same name, you may see an error.

After deleting a field of type Grid (table) and creating/installing a new field of another type (string, long text, etc.), the following error occurs when trying to close or update an incident:

Cannot convert type []interface {} of '[map[] map[]]' to type string, field: sourceip (8902)

This error occurs if you create a field of type table/grid and associate it with an incident type. You then create an incident with that field. Now you delete that table/grid field and create/install a new field with the same name but associate it with a different type (such as short text). When you try to close the incident that has that field, the error occurs. This error can occur with other field type changes if the fields are not of compatible types such as changing the type from long text to boolean or URL to short text.

To resolve this issue, perform the steps in the following procedure.

  1. Go to SettingsOBJECTS SETUPIncidentsTypes .

  2. Select the incident type that contains the changed field.

  3. Click Edit Layouts.

  4. Click “Close” Form if you want to close the incident or “New”/”Edit” Form if you want to edit the incident.

  5. Add the field you changed to the form.

  6. Save the form.

  7. Go to the Incidents page and click the incident.

  8. Click ActionsClose Incident if you want to close the incident or Edit if you want to edit the incident.

  9. In the Custom Field area, reset (delete) the value for the field you changed.

    incident-troubleshoot-change-field-type.png
  10. Click Close Incident or Update Incident.