Close Source alert while closing SOAR case

[migueltubia]

Hi,

we have several sources of alerts integrated in the SOAR. We'd like that, when we close the case in the SOAR, we could automatically close the alert in the origin (like SIEM, MS Defender, etc.). We can execute a playbook manually but we'd like to automate this...

As we cannot create a trigger for this in a playbook, do you know if we can create a job to check this every XX minutes/hours? Is this possible? Any idea?

Thanks!

M.

[pigram86]

it all depends on how you are using the playbooks. We, as a MSSP,  use playbooks to weed out false positives/known issues and perform Tier1 actions before cases get to the the analysts for deeper analysis. If deemed false positive/known issue, we put the product close alert/incident action prior to the SOAR close alert in that branch of the playbook. 

I don't believe that you can use an Integration action in a job. That would most likely have to be coded from scratch.