Troubleshoot Closing Case Incident after Changing Field Type - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
8
Creation date
2024-02-14
Last date published
2024-05-30
Category
Administrator Guide
Solution
Cloud
Abstract

If you delete a grid field and then create a new field of another type with the same name, you may see an error. Troubleshoot ‘Cannot convert type’ error.

After deleting a field of type Grid (table) and creating/installing a new field of another type (string, long text, etc.), the following error occurs when trying to close or update an incident:

Cannot convert type []interface {} of '[map[] map[]]' to type string, field: sourceip (8902)

This error occurs with field type changes if the fields are not of compatible types, such as changing the type from long text to boolean or URL to short text. If you create an incident with that field, delete the field, create a new field with the same name but different type, and then try to close the incident with that field, the error occurs.

For example, create a field of type table/grid and associate it with an incident type. Create an incident with that field and then delete that table/grid field and create/install a new field with the same name but associate it with a different type (such as short text). When you try to close the incident that has that field, the error occurs.

To resolve this issue, perform the following steps.

  1. Go to Settings & InfoSettingsObject SetupIncidentsTypes.

  2. Select the incident type that contains the changed field.

  3. Click Edit Layouts.

  4. Click “Close” Form if you want to close the incident or “New”/”Edit” Form if you want to edit the incident.

  5. Add the field you changed to the form.

  6. Save the form.

  7. Go to the Incidents page and select the incident with the checkmark.

  8. Click Close if you want to close the incident or Edit if you want to edit the incident.

  9. In the Custom Fields area, reset (delete) the value for the field you changed.

  10. Click Close Incident or Update Incident.