[Rtir] Constituencies in RTIR/custom fields

[Carlos Fuentes Bermejo]

Hi Peter,

Why are there two customer CF? it is mainly because the CF in IR queue could store multiple values, and in Investigations queue just one. I think you could disable one of them, and then the other one enabled in both queues.

Cheers,
Carlos

On 13 Nov 2013, at 17:48, Peter Bates <peter.bates at ucl.ac.uk> wrote:

> Signed PGP part
> 
> Hello all
> 
> On 13/11/2013 16:07, Kevin Falcone wrote:
> > Either pre-populate it or change it to a freeform field, although that
> > may act weirdly with the built in reporting.  Try it and see.
> > Tools -> Configuration -> Custom Fields
> 
> I'll give this a go - Custom Fields shows that there are two
> 'Customer' fields, one is 'Select multiple values' (for the IR queue) and the
> other is 'Select one value' (for the Investigations queue).
> 
> Is it not possible to just have one if I'm going to try
> and populate a list?
> 
> Apologies for this - I'll read the workflow document again.
> The majority of our work here is manual response to IDS alerts
> from which we throw an Incident and then into an Investigation.
> 
> --
> Peter Bates
> Senior Information Security Officer   Phone: +44(0)2076792049
> Information Services Division	      Internal Ext: 32049
> University College London
> London WC1E 6BT
> 
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.bestpractical.com/pipermail/rtir/attachments/20131114/853a72b9/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 204 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.bestpractical.com/pipermail/rtir/attachments/20131114/853a72b9/attachment.pgp>