Hi all,
I am attempting to create a new Table chart in Native Dashboards utilizing the recently released SOAR Custom Fields feature.
We are referring the Documentation: https://security.googlecloudcommunity.com/google-security-operations-2/new-feature-support-for-soar-custom-fields-in-native-dashboards-7604
I am trying to display standard case fields alongside two of our custom text fields: "Case ID" and "CID".
Per the documentation, I am using the required syntax paths: - case.custom_fields["Case ID"].string_seq.string_vals - case.custom_fields["CID"].string_seq.string_vals
Whenever I attempt to run the query, the UI returns the following generic backend error: "An error occurred with your query. An unexpected error occurred. Loading Complete."
We have already tried multiple troubleshooting variations to isolate the syntax, all of which fail:
Attempt 1(Using array_distinct in outcome):
$case_name = case.name
match:
$case_name
outcome:
$custom_case_id = array_distinct(case.custom_fields["Case ID"].string_seq.string_vals) $custom_cid = array_distinct(case.custom_fields["CID"].string_seq.string_vals) $total_cases = count(case.name)
Result: "An unexpected error occurred.
When checked the error in developer tools, we found the error “generic::invalid_argument: Querying custom fields is not supported yet: invalid argument”
Could someone help us understand why custom fields are not supported yet?
