XSOAR Incident Workflow implementation

[FrancescoBarducci]

hi,
is there a possibility in xsoar to prevent an incident from being closed if certain conditions are not met? I would like to implement in incident workflow where one part is executed automatically and the other by the analyst, then if certain fields are not valorised prevent the closure of the incident.
Thank you very much
regards

[albmartinez]

Hi @FrancescoBarducci ,

This would be possible by adding a conditional task at the very end of the playbook. The conditional task can have two conditions:

1. A condition that will be used to automate the closure of the incident automatically by adding a standard task using the "closeinvestigation" automation for this branch.

2. The condition that will be used for a manual incident closure.  A standard tasks can be added to this branch (with not automation) that can include details of the manual review that needs to be performed and details explaining that the incident will need to be closed manually. 

[FrancescoBarducci]

hello,
I tried but could not implement the functionality in the way I would like.
Basically, what I would like to implement is a sort of control as happens in ticketing platforms, i.e. if the analyst for example, in the Incidents tab, selects one or more incidents and clicks on "Close", at the moment he is able to close them while I would like it not to be possible to do so in the absence of certain fields valued within the incident. Is it possible to implement this type of control?
Thank you very much
Regards

[NMasse · Accepted solution]

You might want to consider using a post processing script. The example in the docs (required fields to close incident) sounds similar to your needs. 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Administrator-Guide/Create-a-...