Automaticaly close SIEM case

Hi all,
I am tryiing to use shuffle soar to automate some of the task in the SIEM.
One of them is the create and close cases.

when i run the playbook the close case keep giving me error like this:

These cases id has been updated. Please refresh before saving additional updates.

since before that i have call api to mark the case in progress so it seem that there is a conflic in the case action.
Can anyone show me how to do the refresh case like the error.

Thanks for your time

After sometime trying to fix the playbook. I got it working now.
It seems that after the first mark as progress api call the version of the case has been change, so i just put the new version of the case to the close case api call and it works now.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.