Skip to main content
MuhammadFaruqi1
Visitor III
May 12, 2024
Question

Notes for Alerts or Incidents with Statuses other then "Closed" and "Resolved"

  • May 12, 2024
  • 1 reply
  • 909 views

Hi Team,

We have the statuses for Alerts and Incidents. These are:

 

For Alerts: Open, Investigating, Pending, Closed, Re-opened

For Incidents: Open, Awaiting, Resolved, Inactive

 

We can only add the notes when Alert status is "Closed" or if the Incidents Status is "Resolved". 

I just want to know if a note also can be added:
1- To the Alert when the Alert status is changed from Open to either Pending, Re-opened?
2- To the Incident when the Incident status is changed from Open to Avaiting or Inactive.

 

BR,
Burhan

 

#FortiSOAR #SOAR

1 reply

AmitJain
Staff
Staff
May 13, 2024

Try this - Create an "on-update" playbook listening on the Status Change. In the playbook, if triggered, you can check if the last status was "Open". If yes, you can raise a Manual Input pop-up to add in the reason, and pass it as a comment or use how ever you need. 

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!