Notifications for closed SOAR cases

[ar3diu]

Is there a builtin method/job to automatically send email notifications when a SOAR Case is closed?

[f3rz]

It depends on the use case. For example, if you are closing cases using playbook (automatically), you can use Send Email action from Email V2 integration and it will send email right before closing the case. 

https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/email-v2#send_email

If possible, could you please provide more information about the use case. 

[ar3diu]

I'm referring to Security Analysts manually closing cases from the UI when an investigation is concluded and then have a way for the rest of the team to be notified about that case closure event and how it was closed (Reason/Root Cause/Closing Comment)

[SoarAndy · Accepted solution]

Today I don't know of a way OOTB.  You could do this with a custom job that looks at case tagging, which would then reopen a closed cased without tag "emailsent", runs the actions, then closes the case again.

There is a roadmap item that will likely answer this in the future, but it's too early to talk about so I would focus on the above for now.

Andy

[ar3diu]

Could Case Closure be proposed as a new type of Trigger?

[SoarAndy]

It is already something in the eyes of the devs 😉
I can't say any more at this point, sorry.