hi all,
is there a way to demote a case to a container using a playbook?
thank you in advance
@meshorer you just need to update the "container_type" key on the container to "default".
REST is usually the best mechanism for this but the `phantom.update()` call might also work.
API:
https://docs.splunk.com/Documentation/SOARonprem/6.1.1/PlaybookAPI/ContainerAPI#update
REST:
https://docs.splunk.com/Documentation/SOARonprem/6.1.1/PlatformAPI/RESTContainers
@meshorer you just need to update the "container_type" key on the container to "default".
REST is usually the best mechanism for this but the `phantom.update()` call might also work.
API:
https://docs.splunk.com/Documentation/SOARonprem/6.1.1/PlaybookAPI/ContainerAPI#update
REST:
https://docs.splunk.com/Documentation/SOARonprem/6.1.1/PlatformAPI/RESTContainers