IBM QRadar SOAR: Closing Incident with Playbooks
Simple playbook to close a Incident
Configuring the Playbook
In your playbook:
1) add or edit the Get Artifacts script.
Provide the following code:
incident.resolution_id = "Resolved"
if incident.confirmed:
incident.resolution_summary = "Incident was closed with CONFIRMED."
else:
incident.resolution_summary = "Incident was closed with Unconfirmed."
incident.plan_status = "C"
incident.addNote("O Incidente foi finalizado.")