topic Re: Is there automation that delete old incident tikcet? in Cortex XSOAR Discussions

Is there automation that delete old incident tikcet?

LinsongGuo — Wed, 03 May 2023 08:01:08 GMT

I have a job run every 5 mins and it will upload a file to AWS, after it runs it would create an incident which I don't want to keep, is there any out of box automation that can delete incident as well as the artifact the job created to save some space?

Re: Is there automation that delete old incident tikcet?

MBeauchamp2 — Wed, 03 May 2023 15:19:40 GMT

You could use the XSOAR File Management integration (community contributed), and add a step into your playbook to delete the file once it's uploaded to AWS.

https://cortex.marketplace.pan.dev/marketplace/details/XSOARFileManagement/

I wouldn't worry about deleting the Incident, but you can do it via a command in the Core REST API integration.

https://cortex.marketplace.pan.dev/marketplace/details/DemistoRESTAPI/

You would need another job to do it though, won't work if the Incident running your playbook tries to delete itself, then you'd need another playbook to delete that one, and so on (Basically Inception).

Re: Is there automation that delete old incident tikcet?

Josep — Wed, 03 May 2023 16:19:28 GMT

You could use "demisto-delete-incidents (Demisto REST API)" to delete incidents by id.

Re: Is there automation that delete old incident tikcet?

LinsongGuo — Thu, 04 May 2023 02:12:02 GMT

I try to use "demisto-delete-incidents (Demisto REST API)" to test delete an incident, it give me an error

Error from Core REST API is : Script failed to run: TypeError: Cannot read property 'constructor' of undefined at reduce_data (script:183:21(37)) (2603)

what is that mean

Re: Is there automation that delete old incident tikcet?

Josep — Fri, 05 May 2023 06:45:23 GMT

You should install "Demisto REST API (Deprecated)" and insert the API Key

Re: Is there automation that delete old incident tikcet?

LinsongGuo — Sun, 07 May 2023 07:00:47 GMT

I actually find the problem is on the REST API configuration, and API ID should be leave as blank rather than have an value. not sure why but that is how I get rid of the error