- Get Started with Threat Center
- Threat Center
- Threat Center Permissions
- Threat Center Alerts: Read
- Threat Center Alerts: Read, Write, and Delete
- Threat Center Cases: Read
- Threat Center Cases: Read, Write, and Delete
- Threat Center Detection Grouping Rules: Read
- Threat Center Detection Grouping Rules: Read, Write, and Delete
- Threat Center Watchlist: Read
- Threat Center Watchlist: Read, Write, and Delete
- Threat Center Cases
- Threat Center Alerts
- Threat Center Detections
- Threat Center Risk Score
- Configure Threat Center
- Monitor Entities of Interest in Threat Center
- Work on Cases
- Work on Alerts
- Edit and Collaborate in Threat Center
- Use Automation Tools in Threat Center
- Find Cases and Alerts
- Sort Cases or Alerts
- Filter Cases or Alerts
- Search for Cases or Alerts in Threat Center
- Build a Search in Threat Center
- Enter a Search Using Exabeam Query Language in Threat Center
- Enter a Search Using Natural Language in Threat Center
- Run a Recent Search in Threat Center
- Create a New Saved Search in Threat Center
- Run a Saved Search in Threat Center
- Edit a Saved Search in Threat Center
- Delete a Saved Search in Threat Center
- View Case and Alert Metrics
- Get Notified About Threat Center
- Threat Center APIs
Configure Case Closed Supporting Reason
Make the case closed supporting reason mandatory or optional.
When you close a case, the supporting reason is a free text field where you can provide more specific details or context about why you're closing the case. You can configure Threat Center to make this field mandatory or optional.
The setting extends to Automation Management playbooks and API calls. If the case closed supporting reason is mandatory, any playbook or API call that changes the case stage to Closed must provide a supporting reason.
By default, the case closed supporting reason is optional.
In Threat Center, click Settings, then navigate to the Customizations tab.
Disable or enable Require supporting reason:
To make the case closed supporting reason mandatory, toggle Require supporting reason on.
To make the case closed supporting reason optional, toggle Require supporting reason off.
Confirm the action:
If you toggled Require supporting reason on, click Enable.
If you toggled Require supporting reason off, click Disable.
It may take up to one minute for a change in the setting to apply to your environment.