12-13-2021 05:51 AM
Hi Guys,
Facing bit of a hiccup on playbook creation for Qradar. After the XSOAR incident closure I need to close the same alert related to that incident on Qradar too. However I cant find any function to do that in the documentation, I would really appreciate if someone can shed some light on it.
12-14-2021 05:33 PM
If someone came across the same issue, use the automation qradar-offense-update,
To figure out the closing _reason_id and closing_reason_name issue the command !qradar-closing-reasons then pick a reason.
12-14-2021 05:33 PM
If someone came across the same issue, use the automation qradar-offense-update,
To figure out the closing _reason_id and closing_reason_name issue the command !qradar-closing-reasons then pick a reason.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
