Hi Jose,
Have a read of https://www.ibm.com/support/pages/node/6603327
The error means that there is a problem creating the incident in SOAR. In most cases this is because the mapping template is configured incorrectly.
Can you escalate using the default template? Does it affect only a custom template?
Go to /store/docker/volumes/qapp-<app-id>/log/ and have a look at the app.log. What is written to it at the time you manually escalate the offense?
On the SOAR server, run sudo tail -f /usr/share/co3/logs/client.log. What is written to that at the time?
Often there is a requirement set in SOAR that you have not catered for in your template, that is a field needs to be populated in the incident but the template does not populate that field when escalation occurs. Messages in the app.log and client.log should help you determine that field.
If it is a workflow or playbook that cannot run when the incident is created you will see an error in the two log files but it will refer to the workflow, playbook or script which will require your attention. The transaction will be rolled back and the incident will not be created.
If you cannot determine the problem then follow https://www.ibm.com/support/pages/node/1160758 to get the plug-in logs. Get the SOAR logs using https://www.ibm.com/support/pages/node/1846545 as a guide (sudo resPackageLogs -l 2) and open a case with IBM Support with the time you reproduced the problem and we will point you in the right direction. If the problem refers to a piece of custom code such as a workflow, script or playbook the onus is on you to determine what changes need to be made to continue to fulfil you business use cases such as changing the template to populate the required fields.
------------------------------
BEN WILLIAMS
------------------------------