IBM QRadar SOAR

 View Only

 Incident altering prevention

Marsid Bicaku's profile image
Marsid Bicaku posted Tue August 05, 2025 03:21 AM

Hello,

One of our regulation, has a requirement that we should not alter the incident fields, attachments, artifacts etc... after an incident is closed.  Is there a way to achive this?

Best regards,

Marsid Bicaku

Mohamad islam Hamadieh's profile image
Mohamad islam Hamadieh

As per my experiences there is nothing out of the box to do that.

If I want to do that I would do one of these solitons : 

1 - not optimal: but you can hide all tabs but making the tab visible only if the incident is active , this will prevent analysts from editing the fields, but also from viewing them after closure :). 

2 - utilize a rule +  helper.fail script. only issue to this is that you have to add ALL the fields in all tabs into this rule. (I added 4 in the example below).

This rule will run a script, the script can be a single line like 

helper.fail("You are not allowed to edit any field after the incident has been closed")

or you can add more logic to allow certain users to edit the incident by using Principal operations - IBM Documentation

please note that analysts can still reopen the incident and edit the fields , so you might need to look into that :).

Martin Feeney's profile image
Martin Feeney

Mohamad has provided a good answer.

Its also an existing RFE that we're tracking, so you could add your vote to that as well.

https://ibmsecurity.ideas.ibm.com/ideas/R-I-97

Marsid Bicaku's profile image
Marsid Bicaku

Thank you Mohamad, this might be a workaround for the moment. I Also tried to move the incident into different workspace, but still users that were not part of that workspace, could see the incident

Martin Feeney's profile image
Martin Feeney

Re the workspaces suggestion. The key thing to understand about workspaces is any permissions users have at the global (default) workspace also apply to all workspaces, so you would need a permissions hierarchy where they had least amount of global permissions, and then the workspace permissions should achieve your goal.