Incidents Mass / Multiple "Close" button, field trigger script

[JoshBoyd]

Workflow:
From the Incidents page / table, select multiple incidents.

Click the "Close" button that allows closing multiple incidents at one time.
My close form comes up.  I have a field trigger script on one of the fields.

It doesn't look like that field trigger script is running for any of the incidents selected.

For the field trigger script, does anyone know how I would qualify in my script for each incident selected do X.

Thanks in advance,

Boyd

[LancePettay · Accepted solution]

Ok, I have tried various things to get this to work. I was able to reproduce what you were seeing, with it working on a single incident but not multiple. Unfortunately that may be a bug. I noticed in the war room of each respective incident, there is an entry saying the close notes were modified, but it isn't actually modified. You are welcome to report it via support.paloaltonetworks.com

As far as other options, I also tried this in a post-processing script, but fields are kind of locked into a limbo state during post-processing and can't really be changed. If you attempt to set them, they just return to what they were prior to being set.

I unfortunately am not able to come up with any way to get this working as far as your current flow goes.

[JoshBoyd]

Thanks again, I'll open a ticket with support.

[jboyd98]

I received the below response from support and they recommended I re-reach out to the Live community.

===Response==
I synced with the team and this appears to be working as expected as the bulk close flow will post the closeNotes and closeReason to the values set during the incident closure. It performs a get args in the background and then once the script has completed, since the args are originally empty, once the incident is closed, it's wiped from context which is why it's not being populated.

They have requested you open a feature request via http://xsoar.ideas.aha.io/ if you would like this flow altered.

Some potential workarounds would be:
1. Set the close reason and notes before closing multiple incidents - manually or via playbook.
2. Add close reason and notes to your close layout and use a field change script on sentinelclosereason & sentinel_classification_comment to populate the close reason and notes on change.

If you need assistance with these workarounds, I would suggest reaching out to the team via the live community as this then treads into implementation.

======
Option 2 doesn't make sense to me since I already have the field trigger script executing, though I don't have close reason and close notes on the form.  Not sure if anyone could expand on that - 

Option 1:  How would I action the suggestion into a playbook.
i think of a playbook as executing once the incident is created.   Can I call a button to execute a separate play book for closing?

Thanks again