/close-case-artifact

type: Skill
name: close-case-artifact
description: "Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause."
required_roles:
  soar: roles/chronicle.editor
personas: [tier1-analyst, tier2-analyst, tier3-analyst, incident-responder]
generated:
  by: human:dandye
  at: 2026-02-04T06:10:49-05:00

Close Case Artifact Skill

Close a case or alert with the required reason, root cause, and justification comment.

Inputs

• `ARTIFACT_ID` - The ID of the case or alert to close
• `ARTIFACT_TYPE` - Either "Case" or "Alert"
• `CLOSURE_REASON` - Must be one of:
• `MALICIOUS` - Confirmed threat
• `NOT_MALICIOUS` - False positive or benign
• `MAINTENANCE` - System/maintenance activity
• `INCONCLUSIVE` - Unable to determine
• `UNKNOWN` - Unknown/other
• `ROOT_CAUSE` - Must match a predefined root cause (use `get_case_settings_root_causes` to list options)
• `CLOSURE_COMMENT` - Detailed justification for closure
• *(Optional)* `ALERT_GROUP_IDENTIFIERS` - Alert group identifiers
• *(Optional, for alerts)* `ASSIGN_TO_USER` - User to assign closed alert to
• *(Optional, for alerts)* `TAGS` - Comma-separated tags

Workflow

Step 1: Execute Closure

**For Cases:**

secops-soar.siemplify_close_case(
    case_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    alert_group_identifiers=ALERT_GROUP_IDENTIFIERS
)

**For Alerts:**

secops-soar.siemplify_close_alert(
    alert_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    assign_to_user=ASSIGN_TO_USER,
    tags=TAGS
)

Outputs

| Output | Description | |--------|-------------| | `CLOSURE_STATUS` | Success/failure status of the closure |

Common Closure Patterns

| Scenario | Reason | Typical Root Cause | |----------|--------|-------------------| | False Positive | `NOT_MALICIOUS` | "Legit action", "Normal behavior" | | Duplicate | `NOT_MALICIOUS` | "Similar case is already under investigation" | | Benign True Positive | `NOT_MALICIOUS` | "Legit action" | | Confirmed Threat (remediated) | `MALICIOUS` | Varies by threat type | | Unable to determine | `INCONCLUSIVE` | "Insufficient data" |

Get Valid Root Causes

If unsure of valid root cause values:

secops-soar.get_case_settings_root_causes()