Automatic Closure of Manual Cases Failing - Temporary Workaround

[_K_O]

Hi all, 

While working on playbook actions (specifically manual playbooks), I came across an issue when attempting to close them via the Siemplify Close Case action within a playbook. 

When attempting to add this action to a manually created case, SecOps fails with an error stating:

Reason":["The specified condition was not met for \'Reason\'."]},"type":null,"title":"One or more validation errors occurred.","status":400

Steps to Reproduce:

• Create a manual case
• Attack the Close Case action to the case, OR
• Create a playbook which contains the Siemplify Close Case action and run the playbook on the case.

Temporary Workaround:

This bug has been raised with Google support and it is being worked on. If you do come across this issue in the meantime, you can create an action targeting the  "/api/external/v1/cases-queue/bulk-operations/ExecuteBulkCloseCase?format=camel" endpoint used by the manual case closure functionality within SecOps. 

An example of this is provided below:

def close_case(case_id, auth_header, soar_url):
payload = {
"casesIds":[case_id],
"rootCause":"<ROOT_CAUSE>",
"closeReason":<CASE_CLOSURE_REASON>,
"closeComment": "<INSERT_COMMENT>",
"dynamicParameters":[]
}

resp = requests.post(url=soar_url + "/api/external/v1/cases-queue/bulk-operations/ExecuteBulkCloseCase?format=camel",
headers=auth_header, json=payload
)
return resp

 Hope this helps if you are struggling with a similar issue!

[TheChris]

Thanks, I'm facing the same issue. This was caused by a bad recent Google update, gosh their software is a mess, just terrible. Problems after problems!!!

[_K_O · Accepted solution]

This has now been fixed with the newest version of the integration (v85)!