Customize Incident Close Reasons

Customize close reasons for incidents by adding a server configuration in Cortex XSOAR.
The default incident Close Reason values are:
  • False Positive
  • Resolved
  • Duplicate
  • Other
To customize the values you need to add a new server configuration.
  1. Select
    Settings
    About
    Troubleshooting
    Add Server Configuration
    .
  2. Add the following key and value:
    Key
    Value
    incident.closereasons
    A comma separated list. For example,
    False Positive,Resolved,Duplicate,Low Priority,Invalid,Other
    For multi-tenant deployments, you need to add the configuration to each tenant, not only the main account.

Recommended For You