[TA_socradar_incidents_checkpointer]
field.state = string