I can't close the incident with Pre-processing Script

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

I can't close the incident with Pre-processing Script

L2 Linker

Hi all,

 

In the incoming incident for CarbonBlack I use some conditions. If it matches these conditions i want to close the incident in CarbonBlack and XSOAR. (I use pre-processing script)
If i want to close in CarbonBlack and drop in XSOAR, i use demisto.results("False") but i don't want it.  I want to close in both(XSOAR and CarbonBlack).

How can i do that? 

1 accepted solution

Accepted Solutions

L4 Transporter

Hi @YilmazDincer ,

 

As far as I understood you don't want the incident to be dropped but closed. You cannot run a pre-processing script to close the incident as you will need an incident id which does not exist at that stage. If you don't want the incident to be dropped, I can think of two solutions:

 

1. Using post-processing script to close CB alert. I assume you need the below command to close it.

demisto.executeCommand("cb-edr-alert-update", {"channel" :alert_id_extracted_from_incident, "status" : "Resolved"})

2. You can develop and run automation as a first task in the playbook. This task will perform the checks to decide if it should be closed and will return yes or no. If it returns yes you will run cb-edr-alert-update and closeInvestigation automation script as a task. 

 

I hope I could answer your question.

 

View solution in original post

2 REPLIES 2

L4 Transporter

Hi @YilmazDincer ,

 

As far as I understood you don't want the incident to be dropped but closed. You cannot run a pre-processing script to close the incident as you will need an incident id which does not exist at that stage. If you don't want the incident to be dropped, I can think of two solutions:

 

1. Using post-processing script to close CB alert. I assume you need the below command to close it.

demisto.executeCommand("cb-edr-alert-update", {"channel" :alert_id_extracted_from_incident, "status" : "Resolved"})

2. You can develop and run automation as a first task in the playbook. This task will perform the checks to decide if it should be closed and will return yes or no. If it returns yes you will run cb-edr-alert-update and closeInvestigation automation script as a task. 

 

I hope I could answer your question.

 

Thank you for your reply. I thought I'd leave incidents open and close them from the playbook. But I thought maybe there is a solution like demisto.result(2).

  • 1 accepted solution
  • 1225 Views
  • 2 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!