Automatically assign case to the user calling the action "Close Case" or "Merge Cases"

Antoine

Every time a user wants to close a case, the user has to be the one assigned to the case otherwise it will return a message like this:

It would be great if it could automatically assign the case to the user who calls the action.

This would apply when closing or merging cases.

Linus Laeubli

Yes, yes, a thousand times yes :)

We do pretty much the same in Resilient. It does help quite a bit actually

Meir Asiskovich

Hi guys,

My name is Meir Asiskovich, from the product management team.

Can you elaborate here - what's the use case? why would someone would like to close a case when its not assigned to him or his team?

Im mostly curious to know why someone, who is not part of the case analysis, may close it?

BTW, did you consider to use a playbook action to automatically assign the case to that user?

Antoine

Hello Meir,

Here is fictive example to better explain why I asked something like this:

--------

Let's say we have multiple environments using Carbon Black to retrieve alerts.

For some reason, an update from Adobe Flash Player, Carbon Black is generating a tons of false-positive alerts.

There is of course, the possibility to make a playbook to filter these false-positives but since this is something we have not seen before, we need some time to make adjustment. After talking to our SOC, one of the analyst proposed himself to go ahead and close all these cases while others figure out the playbook logic.

--------

At the moment, we would have to assign all cases to the SOC analyst which proposed to close the cases, sounds pretty easy and effortless?

Well, it is not necessarily the case since the "Search's tab" pagination setting is set to have a maximum of 50 cases per pages.

What will happen if the Analyst got 300 cases (exaggeration) to close?

1. We have to assign the cases to the analyst, in that case, 6 pages.
2. We have to close the cases, another 6 pages.

I understand there are ways to automatically close the cases from a playbook, an API call and such but sometimes it's just more practical to also be able to do some ad-hoc tasks because there will always be exceptions.

If you do not consider this to be something that other customers would want, there are other ways to provide a workaround for this. Feel free to ask.

Meir Asiskovich

Hi Antoine,

Thanks for a great explanation - makes much sense now.

So you actually want to allow someone in the team to have the ability to close any case - assigned or not.

Sounds like we can solve it with permissions...

@Linus Laeubli , is that your case as well?

Antoine

Hi Meir,

Yes, I think more granular permissions overall would allow more flexibility to what your customers wants to be able to do.

Thank you,