https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/when-does-a-post-script-exactly-execute/m-p/522105#M1439 <P>Hello,</P> <P>When does a post-script execute? When the incident is completely closed?</P> <P>&nbsp;</P> <P>&nbsp;</P> Tue, 22 Nov 2022 17:34:54 GMT Josep 2022-11-22T17:34:54Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/when-does-a-post-script-exactly-execute/m-p/522105#M1439 <P>Hello,</P> <P>When does a post-script execute? When the incident is completely closed?</P> <P>&nbsp;</P> <P>&nbsp;</P> Tue, 22 Nov 2022 17:34:54 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/when-does-a-post-script-exactly-execute/m-p/522105#M1439 Josep 2022-11-22T17:34:54Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/when-does-a-post-script-exactly-execute/m-p/524160#M1527 <P>Hey&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/226640">@Josep</a>,</P> <P>&nbsp;</P> <P>A post-processing script executes once you click on"close incident" and submit the close form, or once the closeInvestigation automation is run.</P> <P>So it's right when the incident is about to close, and then once the post-processing script completes the incident closes.</P> <P>&nbsp;</P> <P>Note that as stated here:&nbsp;<A href="https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Post-Processing-for-Incidents" target="_blank">https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Post-Processing-for-Incidents</A></P> <P><SPAN>If a post-processing script returns an error, the incident does not close.</SPAN></P> Wed, 14 Dec 2022 22:44:28 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/when-does-a-post-script-exactly-execute/m-p/524160#M1527 nkazinets 2022-12-14T22:44:28Z