> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/close-an-issue.md).

# Close an issue

Once you complete your investigation, perform one of the following actions to close an issue:

* **Manually close an issue:** Right-click an issue and select **Change Status** → Resolved and select a resolution reason.
* **Automatically close an issue:** Run the `closeInvestigation` command in the CLI, in a script, or a playbook task. You can configure this command to run as part of a flow when automating issue investigation.

The `closeInvestigation` command supports the `closeReason` and `closeNotes` arguments. The `closeReason` argument accepts a free text value; however, if the free text value doesn't match one of the defined resolution reasons the `resolution_status` field is set to `Resolved - Other`. To see a description of the resolution reasons, see [Resolution reasons for cases and issues](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md).

{% hint style="info" %}

### Note

When an issue is resolved it remains linked to a case. Once all of the issues in a case are resolved, the case is automatically closed.
{% endhint %}

### Example of using the closeInvestigation command in the CLI

In this example, the command specifies to close the issue and set values for `closeReason` and `closeNotes`.

```programlisting
!closeInvestigation closeReason="Resolved - Known Issue" closeNotes= "Mitigated"
```

### Example of using the closeInvestigation command in a playbook

In this example, the `closeInvestigation` command is used in a playbook and values are set for `closeReason` and `closeNotes`.

![closeInvestigation\_playbook\_example.png](/files/nL1g3fjGy6gSJ7GJjrW2)

### Example of using a variable in the closeReason field

In this example the close reason field specifies the `${tmpCloseReason}` variable value. The `tmpCloseReason` key was added to the issue context data, and the value is drawn from this field.

1. Add the `tmpCloseReason` key and set the value, run the following command in the issue **War Room**:

   ```programlisting
   !Set key=tmpCloseReason value="Resolved - True Positive"
   ```
2. Create a task in your playbook for the closeInvestigation command and set the closeReason field to `${tmpCloseReason}`.

   ![closeInvestigation\_playbook\_example2.png](/files/qZ1hdFBN1Nb4DEO8kKQR)

   When the playbook runs, it draws the value from this field in the context data:

   ![tmpCloseReason\_context\_data.png](/files/VSlDMSUurO5sh6k9yMWg)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/close-an-issue.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.