If you attempt to disposition an alert to an existing case in SAS Visual Investigator, the OK button might remain unavailable (grayed out), which prevents you from dispositioning the alert.
This issue occurs in SAS Visual Investigator Hot Fix 18 and later, until the issue is resolved.
You can work around this issue by completing these steps after selecting Create case from the Disposition drop-down list on the Alerts page or an alert details page:
- In the Create case screen, select the New Case radio button (even though you want to disposition the alert to an existing case).
- With the New Case radio button selected, provide information for the required fields, which out-of-the-box are Description, Case type, Case category, and Case subcategory.
- Select the Existing Case radio button. The OK button should be available (no longer be grayed out).
- Search for the case that you want to disposition the alert to and select it in the grid.
- Click OK.