dandye/ai-runbooks/close-case-artifact

Close Case Artifact Skill

Close a case or alert with the required reason, root cause, and justification comment.

Inputs

• ARTIFACT_ID - The ID of the case or alert to close
• ARTIFACT_TYPE - Either "Case" or "Alert"
• CLOSURE_REASON - Must be one of:
• MALICIOUS - Confirmed threat
• NOT_MALICIOUS - False positive or benign
• MAINTENANCE - System/maintenance activity
• INCONCLUSIVE - Unable to determine
• UNKNOWN - Unknown/other
• ROOT_CAUSE - Must match a predefined root cause (use get_case_settings_root_causes to list options)
• CLOSURE_COMMENT - Detailed justification for closure
• (Optional) ALERT_GROUP_IDENTIFIERS - Alert group identifiers
• (Optional, for alerts) ASSIGN_TO_USER - User to assign closed alert to
• (Optional, for alerts) TAGS - Comma-separated tags

Workflow

Step 1: Execute Closure

For Cases:

secops-soar.siemplify_close_case(
    case_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    alert_group_identifiers=ALERT_GROUP_IDENTIFIERS
)

For Alerts:

secops-soar.siemplify_close_alert(
    alert_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    assign_to_user=ASSIGN_TO_USER,
    tags=TAGS
)

Outputs

Common Closure Patterns

Get Valid Root Causes

If unsure of valid root cause values:

secops-soar.get_case_settings_root_causes()