when Response Tasks go to Work in Progress, the parent Security Incident automatically changes to Contain. We don’t want this behavior, and I found no Business Rule doing it. Where is this roll‑up coming from and how can I disable it?
I found the solution for this issue. The automatic change of the parent Security Incident state is controlled by a system property, not a Business Rule.
Property:sn_si.rollup_task_state Fix: Set the value from true to false to disable the roll‑up behavior and stop the Security Incident from moving to Contain when Response Tasks go In Progress.
