Hiding Incident Types from Specific Role

[michaelsysec242]

Hello all, 

I have recently come across a use case that requires me to hide incidents from the Tier 1 Team during escalation in order that it can be free to be assigned to a Tier 2 analyst. Is there a way to hide an incident based on an incident field being true, through a script or some kind of built - in function?

I don't want to hide tabs or similar. 

Many thanks, 

MR

Cortex XSOAR 

[usahitya1]

Instead of Hiding it, 

1. Make escalation steps in a sub playbook (the name is L2 playbook)
2. In the settings of the L2 playbook, you can mention ( Settings --> roles --> l2 role )

3. By doing that, Even L1 can view it, but they cannot take any action.