Triggering a flow when a Security Incident closes

[ryanreed]

I am creating a flow that performs an API call to a 3rd party service on change of state on an SIR incident. The Flow has a trigger defined for Update on Close Code, Close Reason, and State in the sn_si_incident table.

This flow seems to work except when moving to Closed. I see the 3rd party execution for when the incident moves to the Recover state but I don't see the execution in the 3rd party when moving to the Closed state.

I do see a Flow execution that indicates the Flow may have executed when moving to the Closed state (or maybe the Review state) but was cancelled:

Cancelled : This flow context is cancelled as the associated security incident is closed/cancelled.

 Is there a way to ensure the flow is always run, even when moving to the Closed state? There are actions within the 3rd party that we are looking to perform when the incident closes. I was hoping trigger on Close Code and Close Notes would work but that doesn't seem to happen for me.

Release: Vancouver

Any help would be greatly appreciated.

[ryanreed]

Hi @Dr Atul G- LNG ,

How would I determine which OOTB (Out-of-the-Box?) flow may be causing the issue? The "Cancelled" execution in the history has no action name related to it. The flow execution history lists only the flow/actions I utilized and the 1 cancellation with no action name (see attached screenshot of flow execution history).

For reference, Update is the Flow and Execute is an action called from within the Update Flow.

[Dr Atul G- LNG]

Hi @ryanreed 

Sorry, I am getting confused here . Better log a HI case to SN.

[OlaN]

Hi,

Reviewed the image, you can try to change the trigger advanced options to trigger for both interactive and non-interactive (system generated) sessions.

[Kevin Rafalko1]

Take a look at the business rule "Cancel Playbooks and Flows" which is probably cancelling your flow before it's finished.