topic Re: I can't close the incident with Pre-processing Script in Cortex XSOAR Discussions

I can't close the incident with Pre-processing Script

YilmazDincer — Tue, 11 Jul 2023 11:01:10 GMT

Hi all,

In the incoming incident for CarbonBlack I use some conditions. If it matches these conditions i want to close the incident in CarbonBlack and XSOAR. (I use pre-processing script)
If i want to close in CarbonBlack and drop in XSOAR, i use demisto.results("False") but i don't want it. I want to close in both(XSOAR and CarbonBlack).

How can i do that?

Re: I can't close the incident with Pre-processing Script

gyldz — Tue, 11 Jul 2023 12:57:51 GMT

Hi @YilmazDincer ,

As far as I understood you don't want the incident to be dropped but closed. You cannot run a pre-processing script to close the incident as you will need an incident id which does not exist at that stage. If you don't want the incident to be dropped, I can think of two solutions:

1. Using post-processing script to close CB alert. I assume you need the below command to close it.

demisto.executeCommand("cb-edr-alert-update", {"channel" :alert_id_extracted_from_incident, "status" : "Resolved"})

2. You can develop and run automation as a first task in the playbook. This task will perform the checks to decide if it should be closed and will return yes or no. If it returns yes you will run cb-edr-alert-update and closeInvestigation automation script as a task.

I hope I could answer your question.

Re: I can't close the incident with Pre-processing Script

YilmazDincer — Wed, 12 Jul 2023 14:54:14 GMT

Thank you for your reply. I thought I'd leave incidents open and close them from the playbook. But I thought maybe there is a solution like demisto.result(2).