Closing Alerts (SOAR Action in ServiceNow)

When you close alerts in ServiceNow, the workflow change is sent to Carbon Black Cloud.

• This action can be run from an alert.
• Alerts must be in the Open state to be closed.

To close an alert using the Close Alerts SOAR action:

1. Log in to your ServiceNow instance.
2. Go to VMware Carbon Black Cloud > Alerts.
3. Select any alert that is in an Open state.
4. Click Close Alert.
5. Select an appropriate value from the Reason dropdown list and optionally add a comment. This comment is written to the alert and visible in Carbon Black Cloud.
6. Click OK to close the alert.

The alert is closed in ServiceNow and Carbon Black Cloud and the alert state is updated to Closed. Workflow, Remediation State, and Close Note are also updated for the alert.