Hi all,
While working on playbook actions (specifically manual playbooks), I came across an issue when attempting to close them via the Siemplify Close Case action within a playbook.
When attempting to add this action to a manually created case, SecOps fails with an error stating:
Reason":["The specified condition was not met for \\'Reason\\'."]},"type":null,"title":"One or more validation errors occurred.","status":400Steps to Reproduce:
- Create a manual case
- Attack the Close Case action to the case, OR
- Create a playbook which contains the Siemplify Close Case action and run the playbook on the case.
Temporary Workaround:
This bug has been raised with Google support and it is being worked on. If you do come across this issue in the meantime, you can create an action targeting the "/api/external/v1/cases-queue/bulk-operations/ExecuteBulkCloseCase?format=camel" endpoint used by the manual case closure functionality within SecOps.
An example of this is provided below:
def close_case(case_id, auth_header, soar_url):
payload = {
"casesIds":[case_id],
"rootCause":"<ROOT_CAUSE>",
"closeReason":<CASE_CLOSURE_REASON>,
"closeComment": "<INSERT_COMMENT>",
"dynamicParameters":[]
}
resp = requests.post(url=soar_url + "/api/external/v1/cases-queue/bulk-operations/ExecuteBulkCloseCase?format=camel",
headers=auth_header, json=payload
)
return resp
Hope this helps if you are struggling with a similar issue!
