Close a workflow with a datafeed
I have the following problem:
In the security incident, we create what we have secondary incidents that is link to a normal incident (or primary incident if you prefer).
Most of the time, an incident is set as a secondary after receive some modification, so after it enter into the workflow. The thing is when an incident is set as a secondary incident, all modifications is made from the primary incident (a datafeed updates all modification from the primary to the secondary incident).
The problem is the datafeed which update information doesn't close the workflow, when the secondary incident has the status "incident closed". So we have to close them manually.
My question is can we close the workflow of all secondary incidents with the status closed, thank to a datafeed for exemple ?
Thanks in advanced for your help,
- Community Thread
- Forum Thread
- RSA Archer
- RSA Archer Suite
- security incident
What workflow do you mean:
In custom and advanced you pretty much define rules yourself, so surely you can close it. Not sure about standard as very rarely used it.
It's a custom Workflow. Normaly in the standard, we can automatically close the workflow of a secondary incident if the incident is set to "secondary incident" before any modification, with the step surrounded number 1.
However, all incidents are set to secondary incident after modifications, the step 1 can't be done. That why I try to close the workflow of every secondary incident with the status "closed".
But can't you create report of all parent incidents which have Closed status of their child, and run A2A against such report and move all parent Incidents to Closed status. And add the DDE rule in incident to make such closed records as read only, whcih will make sure that incident will be kinda closed and not used/edited.