XSOAR Search queries

Parans — Thu, 02 Feb 2023 06:03:22 GMT

Hello Team,

Trying to remove tags from multiple cases at one go however failed due to incorrect syntax.

!lr-case-tags-remove case_id:"16563,16532,16626" tag_numbers=154
Should it be split into multiple lines to execute? could someone assist me with the best way to achieve this requirement.

Regards

Parans

Re: XSOAR Search queries

jfernandes1 — Fri, 10 Feb 2023 01:54:12 GMT

You can do this in multiple ways.

1. Incident page - Search for the incidents you want to affect. Select the top-level check box and "Select all" link. Then us the "Run Command" button. Execute the command link this !lr-case-tags-remove case_id=${incident.id} tag_numbers=154

2. Incident Context - Save the incident id's to the context in a list. Issue the command !lr-case-tags-remove case_id=${incident.id} tag_numbers=154 in the warroom. Cortext will handle the looping part. Depending on the incident list size. You might want this to be playbook in quiet mode to improve performance.

topic Re: XSOAR Search queries in Cortex XSOAR Discussions

XSOAR Search queries

Re: XSOAR Search queries