IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Incident Close action control

    Posted 08/02/19 09:17 AM
    How we can control action 'Incident Close', example display this in action menu only when certain tasks are completed or deny closer with helper message  based on some field value.

    ------------------------------
    Dastagirsab Mulla
    ------------------------------


  • 2.  RE: Incident Close action control

    Posted 08/05/19 10:20 AM
    There are a couple of ways that one can control this depending upon your exact needs.

    1. If it is to require the field to have a value before closing, simply mark the required attribute for that field to "On Close"; any fields that have no value, but are required upon close will be prompted to be filled-in before closing the incident is allowed.

    2. If you have a more complicated situation consider a Rule that is triggered upon Incident close, along with other conditions. Such rule(s) can launch an in-product script which can perform further checks if desired. Should the script determine that close should not be allowed it can call:

    helper.fail('Your desired message here')

    and the transaction will not be allowed, with the end-user receiving a pop-up message containing the message yuou have configured within your script.

    ------------------------------
    Marty James
    ------------------------------