closing duplicated tickets in XSOAR & Splunk automatically

[abdulazizh]

Hello,

i am trying to close duplicated tickets on XSOAR and Splunk automatically using pre processing rules (for closing on XSOAR) and post processing rule (for closing on Splunk) which i wrote a script for

However i cannot test the post processing scripts because the pre processing script closes the tickets and i cannot reopen them or access the ticket to run the script to test it before applying the post process rule.

try:
close_reason = str(demisto.args().get('closeReason'))
closing_user = str(demisto.args().get('closingUserId'))
if close_reason == "Duplicate" and closing_user == 'DBot':
EVID = str(demisto.incident()['CustomFields']['splunkeventid'])
user_auto = demisto.executeCommand("setIncident", {'owner' : 'admin'})
demisto.executeCommand("splunk-notable-event-edit", {"eventIDs": EVID ,'owner': user_auto, "comment": "Auto closing this Duplicate Alarm" ,"status":"5" })
else:

EID = str(demisto.incident()['CustomFields']['splunkeventid'])
nota = str(demisto.incident()['CustomFields']['closernote'])
user = str(demisto.incident()['owner'])
demisto.executeCommand("splunk-notable-event-edit", {"eventIDs": EID,'owner': user, "comment": nota ,"status":"5" })

except:
print("you are trying to close a manual ticket")

[gyldz]

Hi @abdulazizh,

If your script works as expected, post-processing should work as well. You cannot run any command on the closed incidents. If you want to test before implementing it, I would recommend having another pre-process rule for fake alerts and doing the testing on those ones by triggering some fake alerts on Splunk. I could not reproduce the issue due to the lack of Splunk integration, but Slack notification with incident details worked. So, you need to make sure the below command works as expected.

demisto.executeCommand("splunk-notable-event-edit", {"eventIDs": EID,'owner': user, "comment": nota ,"status":"5" })