Skip to main content
MuhammadFaruqi1
Visitor III
May 12, 2024
Question

Notes for Alerts or Incidents with Statuses other then "Closed" and "Resolved"

  • May 12, 2024
  • 1 reply
  • 921 views

Hi Team,

We have the statuses for Alerts and Incidents. These are:

 

For Alerts: Open, Investigating, Pending, Closed, Re-opened

For Incidents: Open, Awaiting, Resolved, Inactive

 

We can only add the notes when Alert status is "Closed" or if the Incidents Status is "Resolved". 

I just want to know if a note also can be added:
1- To the Alert when the Alert status is changed from Open to either Pending, Re-opened?
2- To the Incident when the Incident status is changed from Open to Avaiting or Inactive.

 

BR,
Burhan

 

#FortiSOAR #SOAR

1 reply

AmitJain
Staff
Staff
May 13, 2024

Try this - Create an "on-update" playbook listening on the Status Change. In the playbook, if triggered, you can check if the last status was "Open". If yes, you can raise a Manual Input pop-up to add in the reason, and pass it as a comment or use how ever you need. 

Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!