Hello,
When using the Security Operations workspace, we have the hability to go through the stages of the incident:
However, when trying to close the SI, I am getting an error:
And it returns back to "Review" state.
I think the problem is not having the Close Notes and Close Code populated as they are mandatory in the normal UI.
What did you guy do to solve this?
Thought about creating a modal window to populate those fields, but not sure how I would show it when the state changes to Closed (and before throwing the error)
Any guidance would be very much appreciated!
Thanks!
Hello @Pedro Silva4 ,
I have tried to replicate the issue that you are experiencing in a clean instance and I am not able to generate the same error. When I move an SIR from Review to Close the experience is that, on the Close Incident tab, the Close code and Close notes must be populated. Then the Close Incident UI Action selected.
If the Close Incident is clicked before populating the two fields, then a standard message is received.
Have you checked for other configurations or customizations that have been made that may be interrupting the normal process?
- Brad W.
Hi Brad,
Thank you so much for your reply!
Yes you are right, I did the same in my PDI (should have done it before I suppose) and when moving the the incident to "Review" State, then i can see the "Close Incident" tab:
However, from the client's instance, I cannot see this tab:
I was the one that installed the plugin and did some customizations.. but don't think I played with this tab or any code/layout.
I will try to see what's different from my PDI to the client's instance.
Please let me know if you have any ideas!
Hello @Pedro Silva4 , my best guess is something happened to the Client Scripts for those tabs. There are 4 Clients Scripts involved:
Take a look there and see if they match a baseline instance.
