Close an incident when all the linked incidents are closed

[lordstark]

Hi,

I want to be able to close an incident when all the linked incidents (child incidents) are closed. Is there a way to achieve this without having to run a post processing script for each linked incident? Post processing scripts introduce a race condition when two automations check each other out for status at the same time.

[asawyer · Accepted solution]

Hi @lordstark – A post-processing script would've been my first suggestion for your use case. To deal with the risk of a race condition, you could use the Demisto Lock integration (call demisto-lock-get and demisto-lock-release within the script) so only one incident's post-processing script can perform the check at a time.

If that approach doesn't work, another idea is to periodically run a job to check the incidents and close them when all of their linked incidents are closed. However, a post-processing script would be preferable because it would be much more timely and efficient.