> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields.md).
# Incident Fields
Use incident fields to accept or populate incident data coming from incidents. You create fields for information that arrives from third-party integrations in which you want to insert information. The fields are added to Incident Type layouts and are mapped using the Classification and Mapping feature.
Incident Fields can be populated by the incident team members during an investigation, at the beginning of the investigation, or prior to closing the investigation.
{% hint style="info" %}
### Note
Creating incident fields is an iterative process in which you continue to create fields as you gain a better understanding of your needs and the information available in the third-party integrations that you use.
{% endhint %}
You can set and update all system incident fields using the **`setIncident`** command, of which each field is a command argument.
### **Incident Field Types**
You can add the following field types, when adding a new field.
* Attachments : enables adding an attachment, such as .doc, malicious files, reports, images of an incident, etc.
* Boolean (checkbox)
* Date picker
* Grid (table): includes an interactive, editable grid as a field type for selected incident types or all incident types.
* HTML: you can configure the HTML Field by applying your own theme.
* Long text:
* Long text is analyzed and tokenized.
* Long text field entries are indexed as individual words, enabling you to perform advanced searches and use wildcards.
* Case-insensitive.
* Long text fields cannot be sorted and cannot be used in graphical dashboard widgets.
* While editing a long text field, pressing enter will create a newline.
* Markdown: Add [markdown-formatted](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-use-markdown.md) text as a **Template** which will be displayed to users in the field after the indicator is created. Markdown lets you add basic formatting to text to provide a better end-user experience.
* Multi select / Array: Includes two options a) Multi select from a pre-filled list b) An empty array field for the user to add one or more values as a comma separated list.
* Number: can contain any number. The default number is 0. Any quantity can be used.
* Role: roles assigned to the incident determine which users (by the role to which they are assigned) can view the incident.
* Short text:
* Treated as a single unit of text, not indexed by word. Advanced search, including wildcards, is not supported.
* Case sensitive by default, but can be changed to case insensitive when creating the field.
* While editing a short text field, pressing enter will save and close.
* Maximum length 60,000 characters.
* Recommended use is one word entries. Examples: username, email address, etc.
* Single select
* Tags: accepts a single tag or a comma-separated list, not case sensitive.
* Timer/SLA: view how much time is left before an SLA becomes past due, as well as configure actions to take in the event that the SLA does pass.
* URL
* User : a user in the system to state a manager or fallback.
### **Basic Settings**
The following table lists the fields that appear in the Basic Settings page, and their descriptions. The Basic Settings page is available for the following field types:
* Long text
* Multi select
* Short text
* Single select
* Tags
| Name | Description |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Placeholder | Optional text to display in the field when it is empty. This text will appear in the layout, but not in the created indicator. Available for Short text, Long text, Multi select / Array, Tags. |
| Values | A comma separated list of values that are valid values for the field. |
### **Timer/SLA Fields**
The following table lists the fields specific to Timer/SLA fields, and their descriptions.
| Name | Description |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SLA | Determine the amount of time in which this item needs to be resolved. If no value is entered, the field serves as a counter. |
| Risk Threshold | Determine the point in time at which an item is considered at risk of not meeting the SLA. By default, the threshold is 3 days, which is defined in the global system parameter. |
| Run on SLA Breach | In the Run on SLA Breach field, select the script to run when the SLA time has passed. For example, email the supervisor or change the assignee.
Note
Only scripts to which you have added the SLA tag appear in list of scripts that you can select.
When configuring a field trigger script, you have the following options:
Unchecked (recommended for incident modification)
Leave unchecked for the script to execute before the incident is stored in the database. This enables the script to modify the incident field values using commands like !setIncident or other functions, such as demisto.set. Useful in most cases, including performing validations and starting and stopping Timer/SLA fields.
Checked
The script executes after the incident is stored in the database. This mode is intended for actions that use the new field value but do not change the incident itself (such as logging data to an external service).
Note
If you check Run the field triggered script after the new field value is saved:
Inability to modify an incident
The script cannot modify any incident field, including the field that triggered the script or any other custom field.
setIncident
Any attempt within the script to use demisto.executeCommand("setIncident") (for example, to update a custom field with a new value) does not update the context data. The War Room may incorrectly show an entry suggesting the field value was changed.
Determines at which point the field is available.
Note
This attribute affects when the field is available for edit. When New/Edit is selected, the field can be set using setIncident only. When Close is selected, it can be set using the closeInvestigation command. When Both is selected, it is available to be set using both setIncident and closeInvestigation.
Determines if the values in these fields are available when searching.
Note
In most cases, Cortex XSOAR recommends that you select this checkbox so values in the field are available for indexing and querying. However, in some cases, to avoid adverse affects on performance, you should clear this checkbox. For example, if you are ingesting an email to an email body field, we recommend that you not index the field.