Before
An analyst had to locate the original notable event, offense, or incident in the relevant security console after completing an investigation. They then had to copy the decision, comment, and closure information into the source system using its specific workflow.
How it works
- Receive the investigation decision and identify the originating source and case.
- Validate the source and translate the requested status and disposition into the appropriate case update.
- Add the note or comment, close the case when requested, and return the result or a no-case outcome.
Workflow details
- Receive and prepare: The flow accepts the originating system, case identifier, requested status, disposition, and comment, then translates the decision into the format required by the selected branch.
- Route to the source: It validates whether the source is Splunk, QRadar, Sentinel, or a hunt without a source case. Unsupported sources fail clearly, while hunt results are skipped without making an external update.
- Apply the decision: For Splunk, the notable event is marked in progress or closed with the mapped disposition and comment. For QRadar, the flow adds a note and closes the offense when requested. For Sentinel, it rereads the incident, adds the comment, and preserves existing incident fields while applying the requested status and closure classification.
- Return the outcome: The flow returns the case identifier, source, and resulting status, including a skipped result when no originating SIEM case exists.
What changed
The originating case is updated directly from the investigation decision, with source-specific status, note, comment, and closure handling performed automatically; unsupported sources fail clearly and cases without an origin are reported as skipped.
Work removed
Finding the original SIEM case, switching to the source console, copying the investigation comment, entering the disposition, and manually closing the case when required.
Expected outcome
One recurring case lookup and one manual SIEM update can be removed for each supported investigation, helping prevent cases from remaining open solely because the decision was recorded elsewhere.
