demote a case during using playbook

[meshorer]

hi all,

is there a way to demote a case to a container using a playbook?

thank you in advance

[phanTom · Accepted solution]

@meshorer you just need to update the "container_type" key on the container to "default". 

REST is usually the best mechanism for this but the `phantom.update()` call might also work. 

API:
https://docs.splunk.com/Documentation/SOARonprem/6.1.1/PlaybookAPI/ContainerAPI#update 

REST: 
https://docs.splunk.com/Documentation/SOARonprem/6.1.1/PlatformAPI/RESTContainers