IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Good practice for "Automatic cancelation options"

  • 1.  Good practice for "Automatic cancelation options"

    Posted Tue January 31, 2023 03:50 PM
    Hi,
    For many diverse reasons, incidents are sometime closed while a playbook is still running.  This leaves the playbook in a "Suspended" state.
    Would it be a good practice to configure all our playbook with an "Automatic cancelation options" with the cancelation condition "If status is changed to Closed"?
    Thanks

    ------------------------------
    Pierre Dufresne
    ------------------------------


Related Content