close-case-artifact

---
name: close-case-artifact
description: "Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause."
required_roles:
  soar: roles/chronicle.editor
personas: [tier1-analyst, tier2-analyst, tier3-analyst, incident-responder]
---

# Close Case Artifact Skill

Close a case or alert with the required reason, root cause, and justification comment.

## Inputs

- `ARTIFACT_ID` - The ID of the case or alert to close
- `ARTIFACT_TYPE` - Either "Case" or "Alert"
- `CLOSURE_REASON` - Must be one of:
  - `MALICIOUS` - Confirmed threat
  - `NOT_MALICIOUS` - False positive or benign
  - `MAINTENANCE` - System/maintenance activity
  - `INCONCLUSIVE` - Unable to determine
  - `UNKNOWN` - Unknown/other
- `ROOT_CAUSE` - Must match a predefined root cause (use `get_case_settings_root_causes` to list options)
- `CLOSURE_COMMENT` - Detailed justification for closure
- *(Optional)* `ALERT_GROUP_IDENTIFIERS` - Alert group identifiers
- *(Optional, for alerts)* `ASSIGN_TO_USER` - User to assign closed alert to
- *(Optional, for alerts)* `TAGS` - Comma-separated tags

## Workflow

### Step 1: Execute Closure

**For Cases:**
```
secops-soar.siemplify_close_case(
    case_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    alert_group_identifiers=ALERT_GROUP_IDENTIFIERS
)
```

**For Alerts:**
```
secops-soar.siemplify_close_alert(
    alert_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    assign_to_user=ASSIGN_TO_USER,
    tags=TAGS
)
```

## Outputs

| Output | Description |
|--------|-------------|
| `CLOSURE_STATUS` | Success/failure status of the closure |

## Common Closure Patterns

| Scenario | Reason | Typical Root Cause |
|----------|--------|-------------------|
| False Positive | `NOT_MALICIOUS` | "Legit action", "Normal behavior" |
| Duplicate | `NOT_MALICIOUS` | "Similar case is already under investigation" |
| Benign True Positive | `NOT_MALICIOUS` | "Legit action" |
| Confirmed Threat (remediated) | `MALICIOUS` | Varies by threat type |
| Unable to determine | `INCONCLUSIVE` | "Insufficient data" |

## Get Valid Root Causes

If unsure of valid root cause values:
```
secops-soar.get_case_settings_root_causes()
```