IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Don´t allow update closed incidents

    Posted 07/02/19 09:18 AM
    Hi everybody,

    We want to create some metrics about closed incidents and we don´t want users update closed incidents after the incidents have been closed. Is it possible in Resilient?

    Thanks a lot,
    Álvaro

    ------------------------------
    ALVARO DIEZ CAÑAS
    ------------------------------


  • 2.  RE: Don´t allow update closed incidents

    Posted 07/03/19 03:21 AM
    Hi,

    You can use an automatic incident rule with in-product script. The rule can have condition that "Status is Closed", then run in-product script:
    helper.fail("You cannot modify a closed incident")
    When a user tried to modify and save a closed incident, the script will throw an error.


    ------------------------------
    LILY WANG
    ------------------------------



  • 3.  RE: Don´t allow update closed incidents

    Posted 07/04/19 04:57 AM
    FYI,

    Customer Idea on Read only closed incidents
    https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-97

    Customer Idea on Closed Incident Rule
    https://2e4ccba981d63ef83a875dad7396c9a0.ideas.aha.io/ideas/R-I-483

    ------------------------------
    MARTIN FEENEY
    IBM Resilient Product Manager
    IBM Security
    Galway
    ------------------------------