Is there any way to reopen a closed case through API or siemplify module in SecOps SOAR?

Hi ​@harshal.thakor,

Does this help?

Method: cases.executeBulkReopen  |  Google Security Operations  |  Google Cloud Documentation

Kind Regards,

Ayman

Thanks for the response.

Is there any function/module for the same to directly use it in connector script of SOAR IDE?

Hi ​@harshal.thakor,

Not that I know of, but the below should do the job, just add 2x parameters ‘CaseIDs’, and ‘Comment’.

from SiemplifyAction import SiemplifyAction
from SiemplifyUtils import output_handler
import json

@output_handler
def main():
    siemplify = SiemplifyAction()
    API_ROOT = siemplify.API_ROOT
    siemplify.script_name = "Re-Open_Case"
    output_message = ""

    responses = []

    try:
        # Retrieve parameters
        case_id = siemplify.parameters.get("Case IDs")
        comment = siemplify.parameters.get("Comment", "")

        # Prepare request payload
        payload = {
            "reopenComment": comment,
            "casesIds": [case_id]
        }

        siemplify.LOGGER.info(f"Request Payload for case {case_id}:\n{json.dumps(payload, indent=4)}")

        # Make the POST request
        url = f"{API_ROOT}/external/v1/dynamic-cases/ExecuteBulkReopenCase"
        response = siemplify.session.post(url, json=payload)
        response.raise_for_status()

        # Parse and store response
        response_data = response.json()
        responses.append({
            "case_id": case_id,
            "response": response_data
        })

        output_message = json.dumps(responses, indent=4)

    except Exception as e:
        error_message = f"Error executing action. Reason: {e}"

        if hasattr(e, 'response') and e.response is not None:
            try:
                error_body = e.response.text
                siemplify.LOGGER.error(f"HTTP error response:\n{error_body}")
            except Exception as inner_e:
                siemplify.LOGGER.error(f"Failed to parse error body: {inner_e}")

        siemplify.LOGGER.error(error_message)
        siemplify.LOGGER.exception(e)
        siemplify.end(error_message, str(e))
        return

    siemplify.LOGGER.info(f"Response:\n{output_message}")
    siemplify.end(output_message, output_message)


if __name__ == "__main__":
    main()

Kind Regards,

Ayman