Update Case Close Reason Soar icon

Update Case Close Reason Soar

Update close reason of case in Soar

Update Case Close Reason Soar

AI-generated

Overview

This node updates the close reason of a case in a SOAR (Security Orchestration, Automation, and Response) system. It is useful for automating the process of modifying case details, specifically the reason why a case was closed, which can help in maintaining accurate case records and improving incident management workflows. For example, it can be used in security operations to update case statuses after investigation or resolution.

Use Case Examples

  1. Updating the close reason of a security incident case after investigation.
  2. Automatically setting the tenancy code and close reason when closing cases in a multi-tenant SOAR environment.

Properties

Name Meaning
Case ID The ID of the case to retrieve and update.
Tenancy Code Tenancy code for the case, used to specify the tenant context if applicable.
Close Reason The reason for closing the case, which will be updated in the SOAR system.

Output

JSON

  • success - Indicates if the update operation was successful (true or false).
  • response - The response body returned from the SOAR API after the update request.
  • statusCode - HTTP status code returned from the SOAR API.
  • reasonClose - The close reason that was set for the case.
  • error - Error message if the update operation failed.
  • caseName - The name of the case, included in error output for context.

Dependencies

  • Requires credentials for the SOAR API including an API URL and an authentication token.

Troubleshooting

  • Common issues include invalid or missing Case ID, incorrect API URL or token, and network connectivity problems.
  • Error messages typically include HTTP status codes and response bodies from the SOAR API, which help diagnose issues such as authorization failures or invalid request data.
  • If the node is set to continue on fail, it will output error details instead of stopping execution, allowing for partial processing of multiple cases.

Discussion