Notes for Alerts or Incidents with Statuses other then "Closed" and "Resolved"

[MuhammadFaruqi1]

Hi Team,

We have the statuses for Alerts and Incidents. These are:

For Alerts: Open, Investigating, Pending, Closed, Re-opened

For Incidents: Open, Awaiting, Resolved, Inactive

We can only add the notes when Alert status is "Closed" or if the Incidents Status is "Resolved". 

I just want to know if a note also can be added:
1- To the Alert when the Alert status is changed from Open to either Pending, Re-opened?
2- To the Incident when the Incident status is changed from Open to Avaiting or Inactive.

BR,
Burhan

#FortiSOAR #SOAR

[AmitJain]

Try this - Create an "on-update" playbook listening on the Status Change. In the playbook, if triggered, you can check if the last status was "Open". If yes, you can raise a Manual Input pop-up to add in the reason, and pass it as a comment or use how ever you need.