> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/close-an-investigation.md).

# Close an Investigation

At the end of an investigation, you may need to take certain steps before closing it.

This example creates an automation with two mandatory arguments, **reason** and **notes** for closing an open investigation.  The **reason** argument is a list of the four standard investigation close reasons used in Cortex XSOAR: Resolved, False Positive, Duplicate, and Other.

{% hint style="info" %}

### Note

For list options, no spaces are allowed.
{% endhint %}

1. Create an automation and use the **Settings** button to add the mandatory arguments  **reason** and **notes**.

   ![cortex-xsoar-automation-close-investigation.png](/files/kJ8R0U7eOZd0Wld4EqSj)
2. Use the basic automation template to create the following code.

   Since there are two arguments, return the entire arguments dictionary in a single call with **`args = demisto.args()`**.

   Compare the **reason** argument and look up the proper value from a close reason dictionary.

   Replace all spaces in the reason argument and test if it exists in the map.  If not, raise an exception, otherwise retrieve the **notes** argument.  The investigation ID is needed for the close investigation command and is found with the **`demisto.incident()`** function that returns the incident fields as a dictionary.  Only the investigation **id** is required to close an investigation.

   To close the investigation, the **`demisto.executeCommand()`** function is called with the **`closeInvestigation`** command and the options passed as a dictionary.

   ```programlisting
   closeMap = {
       'Resolved':     "Resolved",
       'FalsePositive':"False Positive",
       'Duplicate':    "Duplicate",
       'Other':        "Other"
   }

   def main():
       try:
           args = demisto.args()
           closeReason = args['reason'].replace(" ", "")
           if closeReason in closeMap:
               closeNotes  = args['notes']
               id      = demisto.incident()['id']
               demisto.executeCommand("closeInvestigation", {
                   'id':       id,
                   'closeReason':  closeMap[closeReason],
                   'closeNotes':   closeNotes
               })
           else:
               raise Exception("Invalid close reason = " + 
                       args['reason']
               )
       except Exception as ex:
           demisto.error(traceback.format_exc())  
           return_error("Failed to close investigation: " +
               str(ex)
           )

   if __name__ in ("__main__", "__builtin__", "builtins"):
       main()
   ```
3. Save the completed automation and run it in the War Room of an open incident to test it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/close-an-investigation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.