topic Re: Close Incidents from Preprocess Rule "Script" in Cortex XSOAR Discussions

Close Incidents from Preprocess Rule "Script"

oDarweesh2 — Sun, 04 Jun 2023 11:43:10 GMT

Dears,

Hope you are doing well.

We need to close the Incidents on xsoar from preprocess script, How can we close it using a script in preprocess rule?

I dont need other options like: link and close or drop or close. Because there are some mandatory actions need to be done. the good thing that all what is written in the script is done, except for closing the incident. so does anyone know how to close the ticket?

Re: Close Incidents from Preprocess Rule "Script"

SanDev — Sun, 04 Jun 2023 11:54:55 GMT

Hello, at ths preprocess tab you create the rule and then assign an automation where is the script. At that automation I will just set the closeInvestigation command indicating the current incident id.

Re: Close Incidents from Preprocess Rule "Script"

oDarweesh2 — Sun, 04 Jun 2023 13:48:09 GMT

Hello,

Have you tried it before?? because I tried it and it is not effective

Re: Close Incidents from Preprocess Rule "Script"

shcrews — Wed, 07 Jun 2023 20:59:34 GMT

Enable the logging to trouble shoot. It is possible just needs fine tuning.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Pre-Process-Rules