Security Incident Closing - review response task - new status

[Armando4]

Hi All,

I created a new response task status  called "Not Applicable" that has to take in consideration when closing the related security incident.

Actually, You can close a security incident only when all response tasks are completed but i want to close even if all or some tasks are "Not applicable".

How can i achieve this? In which script is that logical present?

Thank you

[SanjivMeher]

Looks like there is a business rule on the security incident, which prevents closure, if all the tasks are not closed.

Which makes a call to this script include SMTask, where it check state 3,4,7 as closure.

[Armando4]

Many thanks @SanjivMeher ,

I found it and inserted my new state "N/A".

But i encountered another problem: everytime you close a response task, it is set to deactivated and the script include AnalystWorkspaceSIRUtil checks for active tasks:

    checkResponseTasks: function(secIncId) {

        var task = new GlideRecord('sn_si_task');

        task.addQuery('parent', secIncId);

        task.addActiveQuery();

        task.query();

        return task.hasNext();

    }

I need help to find the place where the deactivation operation is performed so i can also include the "N/A" status condition.

Alternatively, i can create a custom BR that set active=false whenever the status changes to "N/A"

Thank you

Many thank