close-case-artifact

To close a security case, you provide the ARTIFACT_ID, ARTIFACT_TYPE, CLOSURE_REASON, ROOT_CAUSE, and CLOSURE_COMMENT. This enforces consistent closure records by validating required inputs before updating the case status.

Documenting false positive closures requires supplying a CLOSURE_REASON, ROOT_CAUSE, and CLOSURE_COMMENT. This validates the alert closure inputs and records the rationale for audits and case management.

Yes, when closing an investigation you can use optional fields like ASSIGN_TO_USER, TAGS, and ALERT_GROUP_IDENTIFIERS. These optional fields are supported alongside the required closure inputs for alerts.

The closure workflow operates across both case and alert workflows. It covers common closure scenarios such as false positives, completed investigations, and maintenance activity by enforcing required inputs.

Omitting the root cause or closure comment fails the input validation step. The workflow enforces required fields—ARTIFACT_ID, ARTIFACT_TYPE, CLOSURE_REASON, ROOT_CAUSE, and CLOSURE_COMMENT—to ensure consistent closure records.