Hi @Chris-N ,
You are not looking in the wrong place—this is due to the architectural difference in how Cases 2.0 (Unified Cases) displays event payloads compared to the Legacy SOAR view.
In Legacy SOAR, the Event tab rendered the raw JSON payload / key-value dictionary directly into custom event UI categories. In Cases 2.0, the UI renders the normalized Unified Data Model (UDM) fields. Custom form fields that aren't mapped directly to standard UDM schema fields won't automatically show up in the default Event Fields pane.
Here are a few ways to make this visible to your analysts:
1. Check the "Raw Log" Tab
In the Cases 2.0 side drawer, switch from Event Fields to the Raw Log tab right next to it. The unmapped custom form attributes (Destination, Dates, Department, etc.) should still reside in the underlying JSON payload.
2. Map Custom Form Fields to additional.fields in the Parser / Webhook Ingestion
If these requests pass through a Parser or Ingestion API, map the MS Form key-values into UDM's additional.fields map (e.g., additional.fields["destination"] = "France"). Cases 2.0 automatically surfaces additional.fields under the Event Fields pane.
3. Surface Data via SOAR Playbook Enrichment (Quickest Fix for Analysts)
Since your playbook still accesses the event data normally:
-
Add a playbook step to extract those specific fields (Destination, Depart Date, Reason, etc.).
-
Write them to Case Custom Fields or add a Case HTML/Markdown Widget on the Overview tab using the Set Case Custom Fields or Create Case Tag/Attachment action.
-
This renders a clean summary card for analysts directly on the Overview view without requiring them to inspect raw events.
Hope this clarifies the Cases 2.0 display change and gives you a good workaround!
