Skip to main content

Bug - SOAR Case id in simulator

  • June 4, 2025
  • 1 reply
  • 11 views

vanitharaj1208
Forum|alt.badge.img+14

Hi All,

I have Observed that case.id value is passing wrong while creating an incident in ServiceNow in simulator mode while testing.

Actual Case id is 10062 but  it passing as 10064.... it is happening in simulator mode

 

1 reply

JoãoGalvão12
Forum|alt.badge.img

This is a known behaviour. When you run a playbook in simulator mode, Google SecOps (GSO) creates a new temporary Case to run that simulation, similar to the Case you selected from the Test Cases, in the simulation dropdown list.

If you go to one of your Cases, and replace the Case ID number in the URL with the Case ID number mentioned when you use the placeholder [Case.Id] inside your playbook, you will see the temporary Case created by the simulation and the actions made by your playbook in it.