Reopen selected incidents in "Investigation" tab

Josep — Fri, 31 Mar 2023 09:37:32 GMT

Hello,

I'd like to reopen the incidents selected after a query in Search Incidents. Not the result of the query, only the selected ones after the query, I'm trying to use the API commando to open them:

body = {"id":f"{incident}","version":version}
uri = f"/investigation/{incident}/reopen"
status = demisto.internalHttpRequest('POST', uri, body=body)

Of course, incident is closed so I can't use this call:

incident = demisto.incidents()[0].get('id')

How can I get the internal id variable of the selected incidents without query them?

Re: Reopen selected incidents in "Investigation" tab

bparmely — Tue, 11 Apr 2023 17:40:40 GMT

Hi @Josep , I have been testing our API recently (tested on both PowerShell and Python), and I was able to reopen closed incidents using the following steps:

1.) Search for the closed incidents you want to reopen using the /incidents/search API endpoint (save these results to a variable)

2.) Add each of the incidents returned from the query (the incident JSON data) into a list

3.) Loop through the list and set the uri with an f string with the incident["id"] value (almost exactly as you had before, except we are accessing the id property

4.) Within the loop, change the incident["version"] value to -1

5.) Run the demisto.internalHttpRequest Method inside of the loop using the following: status = demisto.internalHttpRequest('POST', uri, body=incident)

So everything will look like this after you have already searched for the closed incidents and looped through the incidents and added them to a list called "incidents_list" in this example:

for incident in incidents_list:

incident["version"] = -1

uri = f"/investigation/{incident["id"]}/reopen"

status = demisto.internalHttpRequest("POST", uri=uri, body=incident)

Could you please give this a try and report back? Thank you.

topic Reopen selected incidents in "Investigation" tab in Cortex XSOAR Discussions

Reopen selected incidents in "Investigation" tab

Re: Reopen selected incidents in "Investigation" tab