Common Step: Document Findings/Actions in SOAR Case

Objective

Add a standardized comment to a specified SOAR case to document findings, actions taken, or recommendations.

Scope

This sub-runbook executes the post_case_comment action in the SOAR platform. It assumes the comment content is provided by the calling runbook.

Inputs

• ${CASE_ID}: The SOAR case ID to add the comment to.
• ${COMMENT_TEXT}: The full text of the comment to be added.
• (Optional) ${ALERT_GROUP_IDENTIFIERS}: Relevant alert group identifiers if required by the specific SOAR tool implementation, passed from the calling runbook.

Outputs

• ${COMMENT_POST_STATUS}: Confirmation or status of the comment posting attempt (e.g., Success, Failure, API response).

Tools

• secops-soar: post_case_comment

Workflow Steps & Diagram

1. Receive Input: Obtain ${CASE_ID}, ${COMMENT_TEXT}, and optionally ${ALERT_GROUP_IDENTIFIERS} from the calling runbook.
2. Post Comment: Call soar-mcp_post_case_comment with case_id=${CASE_ID} and comment=${COMMENT_TEXT} (and alert_group_identifiers if needed).
3. Return Status: Store the result/status of the API call in ${COMMENT_POST_STATUS} and return it to the calling runbook.

sequenceDiagram
    participant CallingRunbook
    participant DocumentInSOAR as document_in_soar.md (This Runbook)
    participant SOAR as secops-soar

    CallingRunbook->>DocumentInSOAR: Execute Documentation\nInput: CASE_ID, COMMENT_TEXT, ALERT_GROUP_IDS (opt)

    %% Step 2: Post Comment
    DocumentInSOAR->>SOAR: post_case_comment(case_id=CASE_ID, comment=COMMENT_TEXT, ...)
    SOAR-->>DocumentInSOAR: Comment Post Result (COMMENT_POST_STATUS)

    %% Step 3: Return Status
    DocumentInSOAR-->>CallingRunbook: Return Status:\nCOMMENT_POST_STATUS

Completion Criteria

The post_case_comment action has been attempted. The status (${COMMENT_POST_STATUS}) is available.