Close an incident when all the linked incidents are closed

lordstark — Mon, 15 Jul 2024 11:44:32 GMT

Hi,

I want to be able to close an incident when all the linked incidents (child incidents) are closed. Is there a way to achieve this without having to run a post processing script for each linked incident? Post processing scripts introduce a race condition when two automations check each other out for status at the same time.

Re: Close an incident when all the linked incidents are closed

asawyer — Wed, 17 Jul 2024 00:47:59 GMT

Hi @lordstark – A post-processing script would've been my first suggestion for your use case. To deal with the risk of a race condition, you could use the Demisto Lock integration (call demisto-lock-get and demisto-lock-release within the script) so only one incident's post-processing script can perform the check at a time.

If that approach doesn't work, another idea is to periodically run a job to check the incidents and close them when all of their linked incidents are closed. However, a post-processing script would be preferable because it would be much more timely and efficient.

topic Re: Close an incident when all the linked incidents are closed in Cortex XSOAR Discussions

Close an incident when all the linked incidents are closed

Re: Close an incident when all the linked incidents are closed