Automaticaly close SIEM case

Elastic Security SIEM
1

Hi all,
I am tryiing to use shuffle soar to automate some of the task in the SIEM.
One of them is the create and close cases.

when i run the playbook the close case keep giving me error like this:

These cases id has been updated. Please refresh before saving additional updates.

since before that i have call api to mark the case in progress so it seem that there is a conflic in the case action.
Can anyone show me how to do the refresh case like the error.

Thanks for your time

2

After sometime trying to fix the playbook. I got it working now.
It seems that after the first mark as progress api call the version of the case has been change, so i just put the new version of the case to the close case api call and it works now.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.