IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Good practice for "Automatic cancelation options"

  • 1.  Good practice for "Automatic cancelation options"

    Posted Tue January 31, 2023 03:50 PM
    Hi,
    For many diverse reasons, incidents are sometime closed while a playbook is still running.  This leaves the playbook in a "Suspended" state.
    Would it be a good practice to configure all our playbook with an "Automatic cancelation options" with the cancelation condition "If status is changed to Closed"?
    Thanks

    ------------------------------
    Pierre Dufresne
    ------------------------------