Hey @MKececioglu, indeed performing actions like mirroring and closing offenses in third party tools is not possible when you have link&close as a pre-processing rule.
I would suggest a slightly different approach here instead:
1. When creating the pre-processing rule, only link the incident instead of link and close.
2. In the playbook used for these incidents, create a conditional task as the first task of the playbook, which will divide into the following two branches:
3. You'll want to check if the new incident was linked to a previous one, so you'll check that its' linkedCount field is greater than zero, or equals 1 (since it was just created now and linked to a previous incident, the count will be 1). If this incident isn't linked to a previous one (meaning the rule doesn't apply to it), the count will remain zero.
4. The branch for yes (count = 1) will have the needed actions for closing the offense in QRadar (easiest if you're using mirroring), and will close the incident.
The branch for else (this is an incident that the rule didn't apply to) will simply have all the logic that you had until now for newly created incidents.
Note: If for any reason you need to re-run the playbook for an older incident which will already have newer incidents that were linked to it, the selected branch will be "yes" - as it does have incidents linked to it.
Hey @MKececioglu, indeed performing actions like mirroring and closing offenses in third party tools is not possible when you have link&close as a pre-processing rule.
I would suggest a slightly different approach here instead:
1. When creating the pre-processing rule, only link the incident instead of link and close.
2. In the playbook used for these incidents, create a conditional task as the first task of the playbook, which will divide into the following two branches:
3. You'll want to check if the new incident was linked to a previous one, so you'll check that its' linkedCount field is greater than zero, or equals 1 (since it was just created now and linked to a previous incident, the count will be 1). If this incident isn't linked to a previous one (meaning the rule doesn't apply to it), the count will remain zero.
4. The branch for yes (count = 1) will have the needed actions for closing the offense in QRadar (easiest if you're using mirroring), and will close the incident.
The branch for else (this is an incident that the rule didn't apply to) will simply have all the logic that you had until now for newly created incidents.
Note: If for any reason you need to re-run the playbook for an older incident which will already have newer incidents that were linked to it, the selected branch will be "yes" - as it does have incidents linked to it.
