Allow changes to incidents that are owned by deactivated/inactive platform users in SOAR.

Currently, if I need to make a change to an incident that is owned by a past employee that is deactivated/inactive in Resilient SOAR, I have to reassign that incident to myself or another active user to make the change.

I do not want to have to reassign myself as the owner of a closed and completed incident that was worked by another past employee just to make a change to a field, add a piece of proof, or other documentation to the incident.

I should be able to make the change and leave the owner as the deactivated user.

  • Guest
  • May 3 2021
  • Under review
  • Guest commented
    7 May 08:22pm

    I am currently a member of a group that is listed as a member of the incident. When I try to add myself individually as a member it gives me the same error I get when I try to change any other detail of the incident. Thanks for the suggestion though.

  • Guest commented
    6 May 07:00pm

    If you add yourself as a member to the incident, you can make changes and wouldn't need to re-assign the incident?

  • Guest commented
    4 May 01:04pm

    I fully support this change as it would provide an efficient workflow for my organization.