IBM Security QRadar SOAR

Hi
I have a playbook with sequential tasks, ie tasks only appear after the previous one has been marked complete.
Is there a way to assign automatically the newly created task to the same person who closed the previous one?
Or maybe assign the newly created task to the owner of the incident? ie make tasks inherit the owner id from the incident

Thanks for your help

------------------------------
Pierre Dufresne
------------------------------

Hi Pierre ,

I suggest using : principal.display_name in a script to do that.
this variable capture who ever do an action that triggers a rule.
for example , we are using it to capture the person who close the incident.
when the incident status is changed to close , the following will line will run :
  incident.properties.closed_by = principal.display_name

------------------------------
mohamad islam hamadieh
------------------------------

Original Message:
Sent: Tue October 18, 2022 08:44 AM
From: Pierre Dufresne
Subject: How to make tasks inherit owner id from the incident owber id

Hi
I have a playbook with sequential tasks, ie tasks only appear after the previous one has been marked complete.
Is there a way to assign automatically the newly created task to the same person who closed the previous one?
Or maybe assign the newly created task to the owner of the incident? ie make tasks inherit the owner id from the incident

Thanks for your help

------------------------------
Pierre Dufresne
------------------------------