Create a Post-Processing Script - Administrator Guide - 6.6 - Cortex XSOAR - Cortex - Security Operations

Select Automation → New Automation.

Type a name for the post-processing script and click Save.

In the Tags field, from the dropdown list select Post-processing.

Add fields as required.

Click Save.

Add a Post-Processing Script to the Incident Type.

The following script example requires the user to verify all To Do tasks before closing an incident. Before you start, you need to configure a Cortex XSOAR REST API instance.

commonfields:
  id: c8eeeb6c-3622-4bcb-897a-d183625609fd
  version: 20
vcShouldKeepItemLegacyProdMachine: false
name: ServiceNowCloseIncidentTicket
script: |-
  # return the args and incident details to the war room, useful for seeing what you have available to you
  # args can be called with demisto.args().get('argname')

  # debugging
  # demisto.results(demisto.args())
  # demisto.results(demisto.incident())

  # get the close notes and reason from the XSOAR Incident
  close_reason = demisto.args().get('closeReason')
  close_notes = demisto.args().get('closeNotes','No close notes provided')
  servicenow_sysid = demisto.incident().get("dbotMirrorId", False)

  # map XSOAR close reasons to Service Now close codes
  close_code_map = {
      "False Positive":"Not Solved (Not Reproducible)",
      "Resolved":"Solved (Permanently)",
      "Other":"Solved (Work Around)",
      "Duplicate":"Solved (Work Around)"
  }

  close_code = close_code_map.get(close_reason,"Solved (Work Arounnd")

  # handle if there is no service now sys_id, resolve and close snow ticket
  if servicenow_sysid:
      demisto.results(demisto.executeCommand("servicenow-update-ticket", {"id":servicenow_sysid,"close_code":close_code,"state":6,"close_notes":close_notes}))
      demisto.results(demisto.executeCommand("servicenow-update-ticket", {"id":servicenow_sysid,"state":7}))

  else:
      demisto.results("No ServiceNow sys_id found, doing nothing...")
type: python
tags:
- post-processing
- training
comment: Post processing script to resolve and close Service Now tickets if the XSOAR
  Incident is closed.
enabled: true
scripttarget: 0
subtype: python3
timeout: 80ns
pswd: ""
runonce: false
dockerimage: demisto/python:1.3-alpine
runas: Administrator