Is there a builtin method/job to automatically send email notifications when a SOAR Case is closed?
Solved
Notifications for closed SOAR cases
+8- Silver 2
Best answer by SoarAndy
I'm referring to Security Analysts manually closing cases from the UI when an investigation is concluded and then have a way for the rest of the team to be notified about that case closure event and how it was closed (Reason/Root Cause/Closing Comment)
Today I don't know of a way OOTB. You could do this with a custom job that looks at case tagging, which would then reopen a closed cased without tag "emailsent", runs the actions, then closes the case again.
There is a roadmap item that will likely answer this in the future, but it's too early to talk about so I would focus on the above for now.
Andy
+10It depends on the use case. For example, if you are closing cases using playbook (automatically), you can use Send Email action from Email V2 integration and it will send email right before closing the case.
https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/email-v2#send_email
If possible, could you please provide more information about the use case.
+8- Silver 2
It depends on the use case. For example, if you are closing cases using playbook (automatically), you can use Send Email action from Email V2 integration and it will send email right before closing the case.
https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/email-v2#send_email
If possible, could you please provide more information about the use case.
I'm referring to Security Analysts manually closing cases from the UI when an investigation is concluded and then have a way for the rest of the team to be notified about that case closure event and how it was closed (Reason/Root Cause/Closing Comment)
+12I'm referring to Security Analysts manually closing cases from the UI when an investigation is concluded and then have a way for the rest of the team to be notified about that case closure event and how it was closed (Reason/Root Cause/Closing Comment)
Today I don't know of a way OOTB. You could do this with a custom job that looks at case tagging, which would then reopen a closed cased without tag "emailsent", runs the actions, then closes the case again.
There is a roadmap item that will likely answer this in the future, but it's too early to talk about so I would focus on the above for now.
Andy
+8- Silver 2
Today I don't know of a way OOTB. You could do this with a custom job that looks at case tagging, which would then reopen a closed cased without tag "emailsent", runs the actions, then closes the case again.
There is a roadmap item that will likely answer this in the future, but it's too early to talk about so I would focus on the above for now.
Andy
Could Case Closure be proposed as a new type of Trigger?
+12Could Case Closure be proposed as a new type of Trigger?
It is already something in the eyes of the devs 😉
I can't say any more at this point, sorry.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.