Remove the checkmark when an analyst edits specific fields in a layout.
By default, when editing the following inline values in an incident, the changes are not saved until you confirm your changes (clicking the check mark icon in the value field):
Dropdown values, such as Owner and Severity.
Text values, such as Asset ID. (You can only edit when you click the pencil in the value field).
These icons provide an additional level of security before you make changes to the fields in incidents, indicators, and threat intel reports. If you want to allow users to change to inline fields without clicking the check mark, you need to add a server configuration.
Select → → → → → .
Add the following server configuration.
Key
Value
inline.edit.on.blurSet the server configuration to
true, which enables you to make changes to inline fields without clicking the check mark. The changes are automatically saved when clicking anywhere on the page or when navigating to another page. For text values you can also click anywhere in the value field to edit.