Overview

This node interacts with the Security & Compliance resource of the CIPP API to set the status of a security incident. It allows users to update the incident's status and assign the incident to a specific user. This is useful in security operations and incident management workflows where automated updates to incident statuses are required, such as marking incidents as resolved or assigning them to team members for further investigation.

Use Case Examples

1. Automatically update the status of a security incident to 'Resolved' after investigation.
2. Assign a security incident to a specific analyst for follow-up.

Properties

Output

JSON

• incidentId - The unique identifier of the incident that was updated.
• status - The new status set for the incident.
• assignedTo - The user to whom the incident was assigned.
• message - A message indicating the result of the status update operation.

Dependencies

• Requires an API key credential for authenticating with the CIPP API.

Troubleshooting

• Ensure the tenant ID or domain name is correct and accessible.
• Verify the GUID corresponds to an existing incident or alert.
• Check that the API credentials have sufficient permissions to update incident statuses.
• If SSL issues occur, consider enabling the option to ignore SSL certificate validation, but be aware of security risks.
• Proxy settings must be correctly configured if used, including authentication details if required.
• Timeout settings should be adjusted based on network conditions to avoid premature request termination.

Links

• CIPP API Documentation - Set Incident Status - Official documentation for setting incident status using the CIPP API.