1. Home
    2. Security Operations
    3. Cortex XSOAR
    4. Cortex XSOAR Administrator’s Guide
    5. Incidents
    6. Incidents Management
    7. Customize Incident View Layouts
    8. Customize Incident Close Reasons
    End-of-Life (EoL)

    Customize Incident Close Reasons

    Follow these instructions to customize close reasons for incidents
    The default incident Close Reason values are:
    • False Positive
    • Resolved
    • Duplicate
    • Other
    To customize the values you need to add a new server configuration.
    1. Select
      Settings
      About
      Troubleshooting
      Add Server Configuration
      .
    2. Add the following key and value:
      Key
      Value
      incident.closeReasons
      A comma-separated list. For example,
      False Positive,Resolved,Duplicate,Low Priority,Invalid,Other
      For multi-tenant deployments, you need to add the configuration to each tenant, not only the main account.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2022 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo