close_incident
Resolve or cancel security incidents by specifying the incident state, close code, and note. Enables analysts to formally close incidents with appropriate categorization.
Instructions
Resolve or cancel an incident. request: CloseIncidentRequest { incidentId, state (RESOLVED or CANCELLED), closeCode, closeNote }. Incident close codes: CUSTOMER_ANOMALOUS_SAFE, CUSTOMER_FALSE_POSITIVE, CUSTOMER_TRUE_POSITIVE, FALSE_POSITIVE_CREATE_TUNING_TICKET, CUSTOMER_SECURITY_CONTROL_TESTING, CUSTOMER_CANCELLED. Variables: request. Example variables: {"request":{"closeCode":"CUSTOMER_ANOMALOUS_SAFE","closeNote":"","incidentId":"","state":"RESOLVED"}}
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request | No | GraphQL: CloseIncidentRequest | |
| customer_slug | No | Override the x-reliaquest-customer (OpCo) header. |