Incidents Mass / Multiple "Close" button, field trigger script

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Incidents Mass / Multiple "Close" button, field trigger script

L2 Linker

From the Incidents page / table, select multiple incidents.

Click the "Close" button that allows closing multiple incidents at one time.
My close form comes up.  I have a field trigger script on one of the fields.

It doesn't look like that field trigger script is running for any of the incidents selected.


For the field trigger script, does anyone know how I would qualify in my script for each incident selected do X.


Thanks in advance,



Accepted Solutions

L2 Linker

Ok, I have tried various things to get this to work. I was able to reproduce what you were seeing, with it working on a single incident but not multiple. Unfortunately that may be a bug. I noticed in the war room of each respective incident, there is an entry saying the close notes were modified, but it isn't actually modified. You are welcome to report it via


As far as other options, I also tried this in a post-processing script, but fields are kind of locked into a limbo state during post-processing and can't really be changed. If you attempt to set them, they just return to what they were prior to being set.


I unfortunately am not able to come up with any way to get this working as far as your current flow goes.

View solution in original post


L2 Linker

Hi Josh, I would need to double-check but I'm not sure if field-trigger scripts will work at all on incident closure. Once the incident is closed, most things lose the ability to execute. A field-trigger script wouldn't be triggered until after the fields are modified, therefore the incident would already be closed.


This sounds more like a case for a post-processing script:


Let me know if that helps.



Thanks Lance - 
We do have our field change script working currently when closing a single instance.

It even works if you choose the "mass" close button and only select one record.
it's when you select two or more records; it's like it doesn't understand how to reference or loop through the incidents.

I think I would have the same question even if I created a post processing script.
The example here:


How would I loop through for each incident since there would be more than one:


inc_id = demisto.incidents()[0].get('id')


L2 Linker

Update: I did test this, and I am able to get the field-trigger scripts to work even upon batch incident closure from the incidents page.


There is no need to change the script as it doesn't run any differently when you're closing multiple incidents. It runs from the scope of each individual incident, i.e. the script will run once per incident.


Perhaps there is an issue with the script logic? Maybe the concurrent runs are conflicting somehow? Would you be willing to share the script itself? Please sensor anything that would be considered sensitive to you or your organization.

<Update:  Simplified the script>


Thanks again, appreciate your help

We have a custom field, sentinelclosereason, in our close form.
There's a few reasons we have this, but ultimately when it changes and the incident is closed and the below script will set the system close reason and close the sentinel incident.

This works if close an individual incident directly.

Just trying to debug to see why the multiple case closures aren't setting the close reason and close notes the same.

---Start of Script-----

### Close Sentinel Case
return_results("Trying close sentinel script")
command_sentinel = "azure-sentinel-update-incident"
sentinel_close_reason=demisto.incidents()[0]["CustomFields"].get("sentinelclosereason", None)
sentinel_classification_comment=demisto.incidents()[0]["CustomFields"].get("sentinelclassificationcomment", None)
demisto.executeCommand('setIncident', {'closeNotes': sentinel_classification_comment})
demisto.executeCommand('setIncident', {'closeReason': "Resolved"})



Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!