Customize Incident Close Reasons - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
8
Creation date
2024-09-18
Last date published
2025-01-09
Category
Administrator Guide
Solution
Cloud
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation
Abstract

Customize close reasons for incidents by adding a server configuration in Cortex XSOAR.

The default incident Close Reason values are:

  • False Positive

  • Resolved

  • Duplicate

  • Other

To customize the values you need to add a new server configuration.

  1. Select Settings & InfoSettingsSystemServer Settings+ Add Server Configuration.

  2. Add the following key and value:

    Key

    Value

    incident.closereasons

    A comma separated list. For example, False Positive,Resolved,Duplicate,Low Priority,Invalid,Other.

    Note

    For multi-tenant deployments, you need to add the configuration to each tenant, not only the Main Account.