Close Incident when offense closed via Qradar

[Bar_Magnezi]

Hi , 
Is there any option to automatically close Incident when offense closed via Qradar ?

In the integration setting there is the option - "Close Mirrored XSOAR Incident" but it doesn't for work me.

[gyldz]

Hi @Bar_Magnezi ,

Can you see any errors in the logs? Also, did you define any query in the integration? If you are only getting open offendes, closed ones cannot be mirrored. 

[Bar_Magnezi]

I don't have any errors and I didn't define any Query...

Just to be clear ill explain exactly what I need... 

1. Firstly , An offense started

2. XSOAR makes an incident out of it and a playbook starts to run

3. The playbook is waiting for a user input , but for some reason the analyst closed the offense from the Qradar.

Is there any way to automatically close the incident when the Qradar offense got closed ?

[gyldz]

If the mirroring configuration works as expected, the incident should automatically be closed in XSOAR. Did you select the below option from the instance configuration?

[Bar_Magnezi]

Yes I did select this option and it still doesn't work

[chrking]

Have you enabled mirroring on your QRadar integration? You'll need the "Mirroring Options" selector set to one of the mirror options for the "Close Mirrored XSOAR Incident" option to work.

[OKaraduman1]

If you can not use that "mirroring options". You can create one of the post processing script which design with an automation of "qradar-offense-update"However, mirroring is the best option for this.