I can't close the incident with Pre-processing Script

[YilmazDincer]

Hi all,

In the incoming incident for CarbonBlack I use some conditions. If it matches these conditions i want to close the incident in CarbonBlack and XSOAR. (I use pre-processing script)
If i want to close in CarbonBlack and drop in XSOAR, i use demisto.results("False") but i don't want it.  I want to close in both(XSOAR and CarbonBlack).

How can i do that? 

[gyldz · Accepted solution]

Hi @YilmazDincer ,

As far as I understood you don't want the incident to be dropped but closed. You cannot run a pre-processing script to close the incident as you will need an incident id which does not exist at that stage. If you don't want the incident to be dropped, I can think of two solutions:

1. Using post-processing script to close CB alert. I assume you need the below command to close it.

demisto.executeCommand("cb-edr-alert-update", {"channel" :alert_id_extracted_from_incident, "status" : "Resolved"})

2. You can develop and run automation as a first task in the playbook. This task will perform the checks to decide if it should be closed and will return yes or no. If it returns yes you will run cb-edr-alert-update and closeInvestigation automation script as a task. 

I hope I could answer your question.

[YilmazDincer]

Thank you for your reply. I thought I'd leave incidents open and close them from the playbook. But I thought maybe there is a solution like demisto.result(2).