XSOAR Incident Workflow implementation

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

XSOAR Incident Workflow implementation

L1 Bithead

hi,
is there a possibility in xsoar to prevent an incident from being closed if certain conditions are not met? I would like to implement in incident workflow where one part is executed automatically and the other by the analyst, then if certain fields are not valorised prevent the closure of the incident.
Thank you very much
regards

1 accepted solution

Accepted Solutions

You might want to consider using a post processing script. The example in the docs (required fields to close incident) sounds similar to your needs. 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Administrator-Guide/Create-a-...

 

View solution in original post

3 REPLIES 3

L2 Linker

Hi @FrancescoBarducci ,

 

This would be possible by adding a conditional task at the very end of the playbook. The conditional task can have two conditions:

1. A condition that will be used to automate the closure of the incident automatically by adding a standard task using the "closeinvestigation" automation for this branch.

2. The condition that will be used for a manual incident closure.  A standard tasks can be added to this branch (with not automation) that can include details of the manual review that needs to be performed and details explaining that the incident will need to be closed manually. 

hello,
I tried but could not implement the functionality in the way I would like.
Basically, what I would like to implement is a sort of control as happens in ticketing platforms, i.e. if the analyst for example, in the Incidents tab, selects one or more incidents and clicks on "Close", at the moment he is able to close them while I would like it not to be possible to do so in the absence of certain fields valued within the incident. Is it possible to implement this type of control?
Thank you very much
Regards

You might want to consider using a post processing script. The example in the docs (required fields to close incident) sounds similar to your needs. 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Administrator-Guide/Create-a-...

 

  • 1 accepted solution
  • 1148 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!