> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/close-an-issue.md).

# Close an issue

Close resolved issues in Cortex AgentiX.

Once you complete your investigation, perform one of the following actions to close an issue:

* **Manually close an issue:** Right-click an issue and select **Change Status** → Resolved and select a resolution reason.
* **Automatically close an issue:** Run the `closeInvestigation` command in the CLI, in a script, or a playbook task. You can configure this command to run as part of a flow when automating issue investigation.

The `closeInvestigation` command supports the `closeReason` and `closeNotes` arguments. The `closeReason` argument accepts a free text value; however, if the free text value doesn't match one of the defined resolution reasons the `resolution_status` field is set to `Resolved - Other`. To see a description of the resolution reasons, see [Resolution reasons for cases and issues](/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md).

{% hint style="info" %}

### Notes

* When an issue is resolved it remains linked to a case. Once all of the issues in a case are resolved, the case is automatically closed.
* When you close an issue you have the option to create an issue exclusion rule. This option requires **View/Edit** permission for **Exceptions Configuration > Issue Exclusions**. 
  {% endhint %}

### Example of using the closeInvestigation command in the CLI

In this example, the command specifies to close the issue and set values for `closeReason` and `closeNotes`.

```programlisting
!closeInvestigation closeReason="Resolved - Known Issue" closeNotes= "Mitigated"
```

### Example of using the closeInvestigation command in a playbook

In this example, the `closeInvestigation` command is used in a playbook and values are set for `closeReason` and `closeNotes`.

![closeInvestigation\_playbook\_example.png](https://404732257-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FocwvgxtzkvBHMLbPsZuG%2Fuploads%2Fgit-blob-ef31a41777c13de7c87c3000c5cd71b5f6927f3a%2F0b64ff8633e4da3b328a1db9dde837293578330a20181bd8fe49a01e197a092c.png?alt=media)

### Example of using a variable in the closeReason field

In this example the close reason field specifies the `${tmpCloseReason}` variable value. The `tmpCloseReason` key was added to the issue context data, and the value is drawn from this field.

1. Add the `tmpCloseReason` key and set the value, run the following command in the issue **War Room**:

   ```programlisting
   !Set key=tmpCloseReason value="Resolved - True Positive"
   ```
2. Create a task in your playbook for the closeInvestigation command and set the closeReason field to `${tmpCloseReason}`.

   ![closeInvestigation\_playbook\_example2.png](https://404732257-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FocwvgxtzkvBHMLbPsZuG%2Fuploads%2Fgit-blob-7000019d95f4a849b0f3bdc9057517b56f9e0a2a%2F36cbc948dfea09c38c79c64a44b547debd9c07363c5eccf566748254abcc4705.png?alt=media)

   When the playbook runs, it draws the value from this field in the context data:

   ![tmpCloseReason\_context\_data.png](https://404732257-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FocwvgxtzkvBHMLbPsZuG%2Fuploads%2Fgit-blob-e9d6a94d52e48d278457ada1b195daa6909830b5%2F31e5cd7d82feaa890ca4d8c0b697c992ecc08aa36797e63c7b2e6dcad19fa81b.png?alt=media)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/close-an-issue.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.