# Close Case Artifact

> Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause.

- Skill: `majiayu000/close-case-artifact` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/close-case-artifact`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/close-case-artifact/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Docs & Writing
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/close-case-artifact

---


# Close Case Artifact Skill

Close a case or alert with the required reason, root cause, and justification comment.

## Inputs

- `ARTIFACT_ID` - The ID of the case or alert to close
- `ARTIFACT_TYPE` - Either "Case" or "Alert"
- `CLOSURE_REASON` - Must be one of:
  - `MALICIOUS` - Confirmed threat
  - `NOT_MALICIOUS` - False positive or benign
  - `MAINTENANCE` - System/maintenance activity
  - `INCONCLUSIVE` - Unable to determine
  - `UNKNOWN` - Unknown/other
- `ROOT_CAUSE` - Must match a predefined root cause (use `get_case_settings_root_causes` to list options)
- `CLOSURE_COMMENT` - Detailed justification for closure
- *(Optional)* `ALERT_GROUP_IDENTIFIERS` - Alert group identifiers
- *(Optional, for alerts)* `ASSIGN_TO_USER` - User to assign closed alert to
- *(Optional, for alerts)* `TAGS` - Comma-separated tags

## Workflow

### Step 1: Execute Closure

**For Cases:**
```
secops-soar.siemplify_close_case(
    case_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    alert_group_identifiers=ALERT_GROUP_IDENTIFIERS
)
```

**For Alerts:**
```
secops-soar.siemplify_close_alert(
    alert_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    assign_to_user=ASSIGN_TO_USER,
    tags=TAGS
)
```

## Outputs

| Output | Description |
|--------|-------------|
| `CLOSURE_STATUS` | Success/failure status of the closure |

## Common Closure Patterns

| Scenario | Reason | Typical Root Cause |
|----------|--------|-------------------|
| False Positive | `NOT_MALICIOUS` | "Legit action", "Normal behavior" |
| Duplicate | `NOT_MALICIOUS` | "Similar case is already under investigation" |
| Benign True Positive | `NOT_MALICIOUS` | "Legit action" |
| Confirmed Threat (remediated) | `MALICIOUS` | Varies by threat type |
| Unable to determine | `INCONCLUSIVE` | "Insufficient data" |

## Get Valid Root Causes

If unsure of valid root cause values:
```
secops-soar.get_case_settings_root_causes()
```