Multi-select Field Display

Create an automation script for a display field with custom multi-select options.

You can create a script for a display field with custom multi-select options.

This example automation creates a field called multiselectfield that has a type Multi select . You then define in the Cortex XSOAR console the list of options that can be selected.

1. Use the basic automation template to create the following code.

   The field displayed is passed in the field argument and selectValues contains the list of options that can be selected.

   The Python function sorted() is used to sort the values and update the field options.

   def main():
       try:
           vals = demisto.args()['field']['selectValues']
           return_results({'hidden': False, 'options': sorted(vals)})
       except Exception as ex:
           demisto.error(traceback.format_exc())
           return_error("Failed to sort display field values +
               str(ex)
           )
   
   if __name__ in ("__main__", "__builtin__", "builtins"):
       main()

2. Use the Settings button to add the field-display tag.

   This makes the automation available as a field display automation.
3. Create a new incident field multiselectfield that has a field type Multi select and enter the list of values that can be selected.

   

   cortex-xsoar-automation-multi-select.png
4. In the Attributes tab, select the Field display script and select the automation just created.

   

   cortex-xsoar-automation-select-field-display-script.png
5. In the incident layout created previously (see Add a Table to the Incident Layout), add another section and add the multiselectfield field just created.
6. In an incident, click the multiselectfield and observe the sorted list of options.

   

   cortex-xsoar-automation-drop-down.png