Close Incidents from Preprocess Rule "Script"

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Close Incidents from Preprocess Rule "Script"

L2 Linker



Hope you are doing well.


We need to close the Incidents on xsoar from preprocess script, How can we close it using a script in preprocess rule?

I dont need other options like: link and close or drop or close. Because there are some mandatory actions need to be done. the good thing that all what is written in the script is done, except for closing the incident. so does anyone know how to close the ticket?






L2 Linker

Hello, at ths preprocess tab you create the rule and then assign an automation where is the script. At that automation I will just set the closeInvestigation command indicating the current incident id.

L2 Linker


Have you tried it before?? because I tried it and it is not effective

L1 Bithead

Enable the logging to trouble shoot.  It is possible just needs fine tuning.


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!