CloseLinkedIncidentsPostProcessing

Post Processing Script that will close linked Incidents when the Incident is closed. Will set the same close code as the parent, and add closing notes from the parent.

python · CaseManagement-Generic

Details

ID	`CloseLinkedIncidentsPostProcessing`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.11879924`
Tags	post-processing training internal

README

Post Processing Script that will close linked Incidents when the Incident is closed. Will set the same close code as the parent, and add closing notes from the parent.

Script Data

Name	Description
Script Type	python3
Tags	post-processing, training, internal
Cortex XSOAR Version	6.8.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

CloseLinkedIncidentsPostProcessing.py CloseLinkedIncidentsPostProcessing.yml

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def main():
    incident = demisto.incident()
    close_reason = demisto.args().get("closeReason")
    close_notes = demisto.args().get("closeNotes")
    incident_id = incident.get("id")
    linked_incidents = incident.get("linkedIncidents")

    if linked_incidents and not str(close_notes).startswith("Closed from parent Incident"):
        demisto.executeCommand(
            "executeCommandAt",
            {
                "command": "closeInvestigation",
                "arguments": {
                    "closeReason": close_reason,
                    "closeNotes": f"Closed from parent Incident {incident_id}\n\nClose Notes:\n{close_notes}",
                },
                "incidents": ",".join(linked_incidents),
            },
        )
        demisto.results(f"Closing linked Incidents {','.join(linked_incidents)}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()