Is there a way to mass rename closed XSOAR cases?

weijielim — Fri, 23 Jun 2023 09:37:59 GMT

Hi, I know that we can mass rename active cases but what about mass renaming closed cases? I can rename closed cases one at a time manually but it is super tedious to do so as we have thousands of existing cases. Any suggestions? Thanks.

Re: Is there a way to mass rename closed XSOAR cases?

AbelSantamarina — Wed, 28 Jun 2023 18:32:57 GMT

Hello @weijielim,

You can change the name of a closed incident using the command !setIncident from a different incident, by passing the id of the incident you'd like to rename and the name you'd like to give to it. If you'd like to target multiple incidents at once you will need to wrap that command inside a for loop in an automation.

You can use this basic automation below as an example:

import json query = demisto.args()['query'] new_name = demisto.args()['new_name'] try: incidents = demisto.executeCommand('getIncidents', {'query': query, 'size': '10000'})[0]['Contents']['data'] incident_ids = demisto.dt(incidents,'id') except: demisto.results('No incidents found matching query.') sys.exit(0) if not incidents: demisto.results('No closed incidents found matching query.') sys.exit(0) res = [] for inc_id in incident_ids: try: command_res = demisto.executeCommand("setIncident", {'id': inc_id, 'name': new_name})[0]['Contents'] if "Script failed" not in command_res: res.append({'Incident ID': inc_id, 'Status': "Success"}) else: res.append({'Incident ID': inc_id, 'Status': "Failure"}) except Exception as e: demisto.results(e) sys.exit(0) demisto.results({'Type': entryTypes['note'], 'ContentsFormat': formats['markdown'], 'Contents': tableToMarkdown(name='Renamed Incidents', t=res) })

This works for both Active and Closed incidents.

topic Re: Is there a way to mass rename closed XSOAR cases? in Cortex XSOAR Discussions

Is there a way to mass rename closed XSOAR cases?

Re: Is there a way to mass rename closed XSOAR cases?