How do I install the Close Case Artifact skill?

Run npx skillmds@latest add tomevault-io/close-case-artifact in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Close Case Artifact safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Close Case Artifact?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Close Case Artifact free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Close Case Artifact?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Close Case Artifact by tomevault-io

Name: Close Case Artifact
Author: tomevault-io

Close Case Artifact

Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause. Use when this capability is needed.

tomevault-io Updated Sep 17, 2026

File contents

Close Case Artifact Skill

Close a case or alert with the required reason, root cause, and justification comment.

Inputs

ARTIFACT_ID - The ID of the case or alert to close
ARTIFACT_TYPE - Either "Case" or "Alert"
CLOSURE_REASON - Must be one of:
- MALICIOUS - Confirmed threat
- NOT_MALICIOUS - False positive or benign
- MAINTENANCE - System/maintenance activity
- INCONCLUSIVE - Unable to determine
- UNKNOWN - Unknown/other
ROOT_CAUSE - Must match a predefined root cause (use get_case_settings_root_causes to list options)
CLOSURE_COMMENT - Detailed justification for closure
(Optional) ALERT_GROUP_IDENTIFIERS - Alert group identifiers
(Optional, for alerts) ASSIGN_TO_USER - User to assign closed alert to
(Optional, for alerts) TAGS - Comma-separated tags

Workflow

Step 1: Execute Closure

For Cases:

secops-soar.siemplify_close_case(
    case_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    alert_group_identifiers=ALERT_GROUP_IDENTIFIERS
)

For Alerts:

secops-soar.siemplify_close_alert(
    alert_id=ARTIFACT_ID,
    reason=CLOSURE_REASON,
    root_cause=ROOT_CAUSE,
    comment=CLOSURE_COMMENT,
    assign_to_user=ASSIGN_TO_USER,
    tags=TAGS
)

Outputs

Output	Description
`CLOSURE_STATUS`	Success/failure status of the closure

Common Closure Patterns

Scenario	Reason	Typical Root Cause
False Positive	`NOT_MALICIOUS`	"Legit action", "Normal behavior"
Duplicate	`NOT_MALICIOUS`	"Similar case is already under investigation"
Benign True Positive	`NOT_MALICIOUS`	"Legit action"
Confirmed Threat (remediated)	`MALICIOUS`	Varies by threat type
Unable to determine	`INCONCLUSIVE`	"Insufficient data"

Get Valid Root Causes

If unsure of valid root cause values:

secops-soar.get_case_settings_root_causes()

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: close-case-artifactdescription: Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause. Use when this capability is needed.---# Close Case Artifact SkillClose a case or alert with the required reason, root cause, and justification comment.## Inputs- `ARTIFACT_ID` - The ID of the case or alert to close- `ARTIFACT_TYPE` - Either "Case" or "Alert"- `CLOSURE_REASON` - Must be one of: - `MALICIOUS` - Confirmed threat - `NOT_MALICIOUS` - False positive or benign - `MAINTENANCE` - System/maintenance activity - `INCONCLUSIVE` - Unable to determine - `UNKNOWN` - Unknown/other- `ROOT_CAUSE` - Must match a predefined root cause (use `get_case_settings_root_causes` to list options)- `CLOSURE_COMMENT` - Detailed justification for closure- *(Optional)* `ALERT_GROUP_IDENTIFIERS` - Alert group identifiers- *(Optional, for alerts)* `ASSIGN_TO_USER` - User to assign closed alert to- *(Optional, for alerts)* `TAGS` - Comma-separated tags## Workflow### Step 1: Execute Closure**For Cases:**```secops-soar.siemplify_close_case( case_id=ARTIFACT_ID, reason=CLOSURE_REASON, root_cause=ROOT_CAUSE, comment=CLOSURE_COMMENT, alert_group_identifiers=ALERT_GROUP_IDENTIFIERS)```**For Alerts:**```secops-soar.siemplify_close_alert( alert_id=ARTIFACT_ID, reason=CLOSURE_REASON, root_cause=ROOT_CAUSE, comment=CLOSURE_COMMENT, assign_to_user=ASSIGN_TO_USER, tags=TAGS)```## Outputs| Output | Description ||--------|-------------|| `CLOSURE_STATUS` | Success/failure status of the closure |## Common Closure Patterns| Scenario | Reason | Typical Root Cause ||----------|--------|-------------------|| False Positive | `NOT_MALICIOUS` | "Legit action", "Normal behavior" || Duplicate | `NOT_MALICIOUS` | "Similar case is already under investigation" || Benign True Positive | `NOT_MALICIOUS` | "Legit action" || Confirmed Threat (remediated) | `MALICIOUS` | Varies by threat type || Unable to determine | `INCONCLUSIVE` | "Insufficient data" |## Get Valid Root CausesIf unsure of valid root cause values:```secops-soar.get_case_settings_root_causes()```---> Converted and distributed by [TomeVault](https://tomevault.io/claim/dandye) — claim your Tome and manage your conversions.

Frequently asked questions