SOAR roles and viewing cases

Question

Understandably, a SOAR role can only see its cases and cases of other roles configured under “Additional Roles Access” but does this include closed cases? And if so, does that make sense?

I have an instance where alerts are coming in and the playbook is sending emails to a SOC with links to the cases. However, on occasion an administrator will take ownership and close a case causing the link in the email to now go to an empty screen.

Thanks

mccrilb · Answer

When case’s are closed, do you handle this with a playbook? You could check in the playbook the assignment and change it there to an assignment that will work for your use case.

If not, I would suggest creating one and having the cases closed with your playbooks.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded