<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi Peter,<div><br></div><div>Why are there two customer CF? it is mainly because the CF in IR queue could store multiple values, and in Investigations queue just one. I think you could disable one of them, and then the other one enabled in both queues.</div><div><br></div><div>Cheers,</div><div>Carlos</div><div><br><div><div>On 13 Nov 2013, at 17:48, Peter Bates <<a href="mailto:peter.bates@ucl.ac.uk">peter.bates@ucl.ac.uk</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><fieldset style="padding-top:10px; border:0px; border: 3px solid #CCC; padding-left: 20px;"><legend style="font-weight:bold">Signed PGP part</legend><div style="padding-left:3px;"><br>Hello all<br><br>On 13/11/2013 16:07, Kevin Falcone wrote:<br>> Either pre-populate it or change it to a freeform field, although that<br>> may act weirdly with the built in reporting.<span class="Apple-converted-space"> </span> Try it and see.<br>> Tools -> Configuration -> Custom Fields<br><br>I'll give this a go - Custom Fields shows that there are two<br>'Customer' fields, one is 'Select multiple values' (for the IR queue) and the<br>other is 'Select one value' (for the Investigations queue).<br><br>Is it not possible to just have one if I'm going to try<br>and populate a list?<br><br>Apologies for this - I'll read the workflow document again.<br>The majority of our work here is manual response to IDS alerts<br>from which we throw an Incident and then into an Investigation.<br><br>--<br>Peter Bates<br>Senior Information Security Officer<span class="Apple-converted-space"> </span> Phone: +44(0)2076792049<br>Information Services Division<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-converted-space"> </span> <span class="Apple-converted-space"> </span> <span class="Apple-converted-space"> </span> Internal Ext: 32049<br>University College London<br>London WC1E 6BT</div></fieldset><br><br></blockquote></div><br></div></body></html>