topic Re: Auto Incidnet closure in Cortex XSOAR Discussions

Auto Incidnet closure

Mohamad_1221 — Mon, 27 Nov 2023 07:50:10 GMT

Dear Community,

I'm looking for a way to daily automatically close all incidents with specific criteria.

I'm trying to archive that using jobs , I'm trying to create a playbook the query incidents (with specific criteria) and whatever the query outcome I need to close those incidents.

any suggestions on achieving that , I'm open for all suggestion.

Thanks.

Re: Auto Incidnet closure

gyldz — Wed, 29 Nov 2023 09:51:40 GMT

Hi @Mohamad_1221 ,

You can run a job with 2 tasks. The first one will be SearchIncidentsV2 or SearchIncidentsSummary where you can define a query for the incidents to be closed. The output of those tasks might be huge, you can use ExtendContext and ignore the output option.ExtendContext would be something like FoundIncidents=Contents.data={"name": val.name, "id": val.id}. As a second task you can use closeInvestigation automation and define id field as a ${FoundIncidents.id} and other fields like close reason.

I hope this solves your problem.

Best Regards,