Auto Incidnet closure

[Mohamad_1221]

Dear Community,

I'm looking for a way to daily automatically close all incidents with specific criteria.

I'm trying to archive that using jobs , I'm trying to create a playbook the query incidents (with specific criteria) and whatever the query outcome I need to close those incidents.

any suggestions on achieving that , I'm open for all suggestion.

Thanks.

[gyldz]

Hi @Mohamad_1221 ,

You can run a job with 2 tasks. The first one will be SearchIncidentsV2 or SearchIncidentsSummary where you can define a query for the incidents to be closed. The output of those tasks might be huge, you can use ExtendContext and ignore the output option.ExtendContext would be something like FoundIncidents=Contents.data={"name": val.name, "id": val.id}. As a second task you can use closeInvestigation automation and define id field as a ${FoundIncidents.id} and other fields like close reason.

I hope this solves your problem. 

Best Regards,