This document explains how to use custom fields to collect and manage
information during the case closure process.
Create a custom field
You must create a custom field with a specific scope before it can be used in
the Close Case dialog. The Scope, Type, and Name of
a custom field are mandatory and can't be modified after it's saved.
To create a custom field for the Close Case dialog, follow these
steps:
Go to SOAR Settings > Case Data > Custom Fields.
Click AddAdd Custom Fields.
Set the Scope to either Case or All. Custom fields
with an Alert scope can't be used in the Close Case dialog.
Enter a custom field Name.
Select a custom field Type from the list:
Free Text: Enter any text, up to 1,024 characters.
Radio Button: Provides two customizable options for selection.
Single Select: List with a single option to select. This type
supports a maximum of 1,024 characters, with each option name limited to
255 characters.
Multi Select: List with multiple options to select. This type
supports a maximum of 1,024 characters, with each option name limited to
255 characters.
Calendar: A date and time field. The default format is DD/MM/YYYY HH:MM:SS.
Click Save.
Add a custom field to the Close Case dialog
After you create a custom field with the correct scope, you can add it to the
Close Case dialog.
Go to SOAR Settings > Case Data > Close Case.
In the Custom Fields section, click
settings
Settings.
In the Case Closure Fields side drawer, click Manage Custom
Fields.
Select the custom fields you want to display in the Close Case
dialog. You can select up to 1,000 custom fields.
Click Save.
Close a single case
When you close a case individually, you can enter additional information for
the custom fields you added to the Close Case dialog.
Go to the case you want to close, then click Close Case.
In the Close Case dialog, the standard Reason and
Root Cause fields appear alongside any custom fields that have been
added. Select the appropriate options for your case and enter any additional
comments. These comments will be posted on the Case Wall.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-07 UTC."],[],[],null,["Use custom fields in the Close Case dialog \nSupported in: \nGoogle secops [SOAR](/chronicle/docs/secops/google-secops-soar-toc)\n\nThis document explains how to use custom fields to collect and manage\ninformation during the case closure process.\n\nCreate a custom field\n\nYou must create a custom field with a specific scope before it can be used in\nthe **Close Case** dialog. The **Scope** , **Type** , and **Name** of\na custom field are mandatory and can't be modified after it's saved.\n\nTo create a custom field for the **Close Case** dialog, follow these\nsteps:\n\n1. Go to **SOAR Settings \\\u003e Case Data \\\u003e Custom Fields**.\n2. Click Add **Add Custom Fields**.\n3. Set the **Scope** to either **Case** or **All** . Custom fields with an **Alert** scope can't be used in the **Close Case** dialog.\n4. Enter a custom field **Name**.\n5. Select a custom field **Type** from the list:\n - **Free Text**: Enter any text, up to 1,024 characters.\n - **Radio Button**: Provides two customizable options for selection.\n - **Single Select**: List with a single option to select. This type supports a maximum of 1,024 characters, with each option name limited to 255 characters.\n - **Multi Select**: List with multiple options to select. This type supports a maximum of 1,024 characters, with each option name limited to 255 characters.\n - **Calendar** : A date and time field. The default format is `DD/MM/YYYY HH:MM:SS`.\n6. Click **Save**.\n\nAdd a custom field to the Close Case dialog\n\nAfter you create a custom field with the correct scope, you can add it to the\n**Close Case** dialog.\n\n1. Go to **SOAR Settings \\\u003e Case Data \\\u003e Close Case**.\n2. In the **Custom Fields** section, click settings **Settings**.\n3. In the **Case Closure Fields** side drawer, click **Manage Custom\n Fields**.\n4. Select the custom fields you want to display in the **Close Case** dialog. You can select up to 1,000 custom fields.\n5. Click **Save**.\n\nClose a single case\n\nWhen you close a case individually, you can enter additional information for\nthe custom fields you added to the **Close Case** dialog.\n\n1. Go to the case you want to close, then click **Close Case**.\n2. In the **Close Case** dialog, the standard **Reason** and **Root Cause** fields appear alongside any custom fields that have been added. Select the appropriate options for your case and enter any additional comments. These comments will be posted on the **Case Wall**.\n3. Click **Close**.\n\n| **Note:** The **Close Case** dialog for bulk operations doesn't include custom fields. Custom field values can differ between cases. To update or use custom fields, you must close each case individually.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
Close Case.