Skip to main content

Update Offense

Update an offense.

External Documentation

To learn more, visit the QRadar documentation.


Assign toA user to assign the offense to.
Closing Reason IDThe ID of a closing reason. You must provide a valid closing_reason_id when you close an offense.
Offense IDThe ID of the offense to update.
StatusThe new status for the offense. Set to one of: OPEN, HIDDEN, CLOSED. When the status of an offense is being set to CLOSED, a valid closing_reason_id must be provided. To hide an offense, use the HIDDEN status. To show a previously hidden offense, use the OPEN status.

Workflow Library Example

Update Offense with Qradar and Send Results Via Email

Workflow LibraryPreview this Workflow on desktop