Update an offense.

External Documentation

To learn more, visit the QRadar documentation.

Parameters

ParameterDescription
Assign toA user to assign the offense to.
Closing Reason IDThe ID of a closing reason. You must provide a valid closing_reason_id when you close an offense.
Offense IDThe ID of the offense to update.
StatusThe new status for the offense. Set to one of: OPEN, HIDDEN, CLOSED. When the status of an offense is being set to CLOSED, a valid closing_reason_id must be provided. To hide an offense, use the HIDDEN status. To show a previously hidden offense, use the OPEN status.

Workflow Library Example

Update Offense with Qradar and Send Results Via Email

Preview this Workflow on desktop