Triggering a flow when a Security Incident closes

[ryanreed]

I am creating a flow that performs an API call to a 3rd party service on change of state on an SIR incident. The Flow has a trigger defined for Update on Close Code, Close Reason, and State in the sn_si_incident table.

This flow seems to work except when moving to Closed. I see the 3rd party execution for when the incident moves to the Recover state but I don't see the execution in the 3rd party when moving to the Closed state.

I do see a Flow execution that indicates the Flow may have executed when moving to the Closed state (or maybe the Review state) but was cancelled:

Cancelled : This flow context is cancelled as the associated security incident is closed/cancelled.

 Is there a way to ensure the flow is always run, even when moving to the Closed state? There are actions within the 3rd party that we are looking to perform when the incident closes. I was hoping trigger on Close Code and Close Notes would work but that doesn't seem to happen for me.

Release: Vancouver

Any help would be greatly appreciated.

[OlaN]

Hi,

Haven't worked with the SIR module, but I'm guessing there is some business rule that cancels all ongoing Flows when the record goes inactive.

[Dr Atul G- LNG]

Hi @ryanreed 

You need to update the flow but if conditions matches it will cancel/close. SO it is OOTB. 

[ryanreed]

 Hi @Dr Atul G- LNG, can you expand on what you mean as I don't think I understand? Is there something I can do in the flow to have it trigger for cancel/close? Attached is an example of the current Flow trigger.

[Dr Atul G- LNG]

Hi @ryanreed 

You need to check is any OOTB flow attached which is causing this issue.