Use post-processing scripts in an incident

Use post-processing scripts for incidents in Cortex XSOAR 8.10 On-prem.

Post-processing scripts perform actions on an incident after it is remediated but before it is closed by an analyst or automatically in a script or playbook. For example, after remediating an incident, an analyst may want to perform additional actions on the incident, such as closing a ticket in a ticketing system, sending an email, or preventing an incident from being closed without an assigned owner. You can create a post-processing script to cover these scenarios.

The following content packs include post-processing scripts:

• Common Scripts: Includes the GenerateInvestigationSummaryReport script, which generates a report when an investigation is closed.
• Case Management - Generic: Includes the CloseLinkedIncidentsPostProcessing, which closes any linked incidents when the incident is closed.

You can search for post-processing scripts on the Scripts page by using the Tags filter and typing post-processing.

You need to create a post-process script and then add the script to the incident type.

Example 11.

For an example of creating post-processing scripts that prevent an incident from being closed without an assigned user or the close notes not being filed out correctly, together with a Service Now example, see the following video: Post Processing Scripts.