Close Incidents from Preprocess Rule "Script"

[oDarweesh2]

Dears,

Hope you are doing well.

We need to close the Incidents on xsoar from preprocess script, How can we close it using a script in preprocess rule?

I dont need other options like: link and close or drop or close. Because there are some mandatory actions need to be done. the good thing that all what is written in the script is done, except for closing the incident. so does anyone know how to close the ticket?

[SanDev]

Hello, at ths preprocess tab you create the rule and then assign an automation where is the script. At that automation I will just set the closeInvestigation command indicating the current incident id.

[oDarweesh2]

Hello,

Have you tried it before?? because I tried it and it is not effective

[shcrews]

Enable the logging to trouble shoot.  It is possible just needs fine tuning. 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Pre-Pr...