Close an issue - You can close an issue by running the closeInvestigation command. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation
Product
Cortex XSIAM
Creation date
2025-07-15
Last date published
2026-06-11
Category
Administrator Guide
Abstract

You can close an issue by running the closeInvestigation command.

Once you complete your investigation, perform one of the following actions to close an issue:

  • Manually close an issue: Right-click an issue and select Change Status → Resolved and select a resolution reason.

  • Automatically close an issue: Run the closeInvestigation command in the CLI, in a script, or a playbook task. You can configure this command to run as part of a flow when automating issue investigation.

The closeInvestigation command supports the closeReason and closeNotes arguments. The closeReason argument accepts a free text value; however, if the free text value doesn't match one of the defined resolution reasons the resolution_status field is set to Resolved - Other. To see a description of the resolution reasons, see Resolution reasons for cases and issues.

Note

When an issue is resolved it remains linked to a case. Once all of the issues in a case are resolved, the case is automatically closed.

Example 163. Example of using the closeInvestigation command in the CLI

In this example, the command specifies to close the issue and set values for closeReason and closeNotes.

!closeInvestigation closeReason="Resolved - Known Issue" closeNotes= "Mitigated"

Example 164. Example of using the closeInvestigation command in a playbook

In this example, the closeInvestigation command is used in a playbook and values are set for closeReason and closeNotes.

closeInvestigation_playbook_example.png

Example 165. Example of using a variable in the closeReason field

In this example the close reason field specifies the ${tmpCloseReason} variable value. The tmpCloseReason key was added to the issue context data, and the value is drawn from this field.

  1. Add the tmpCloseReason key and set the value, run the following command in the issue War Room:

    !Set key=tmpCloseReason value="Resolved - True Positive"

  2. Create a task in your playbook for the closeInvestigation command and set the closeReason field to ${tmpCloseReason}.

    closeInvestigation_playbook_example2.png

    When the playbook runs, it draws the value from this field in the context data:

    tmpCloseReason_context_data.png