topic Re: Using SearchIncidentsV2 or GetIncidentsByQuery in automations in Cortex XSOAR Discussions

Using SearchIncidentsV2 or GetIncidentsByQuery in automations

sdes — Sat, 29 Jul 2023 09:40:57 GMT

Hi,

First of all, we are using a lot of automations searching for incidents using queries often with more than 100 results.

The scripts line looks like this:

res = demisto.executeCommand('SearchIncidentsV2', {'query': query, 'limit': 5000})[0].get('Contents')

It seems however the "Content" only contains 100 results even though it shows the right number of incidents

To have access to the datas you have to add something like this too:

inc_data = res[0].get('Contents').get('data')

Still 100 results even with the limit higher

I, however, found that not using "Contents" but "EntryContext" provides everything, the script lines are a little bit more complex:

res = demisto.executeCommand('SearchIncidentsV2', {'query': query, 'limit': 5000})[0].get('EntryContext')

inc_data = res.get('foundIncidents(val.id && val.id == obj.id)'

This is not very clean.

The only solution we have so far is by using GetIncidentsByQuery as below:

res = json.loads(demisto.executeCommand('GetIncidentsByQuery', {'query': query, 'limit': 5000})[0].get('Contents'))

This is working perfectly

Is there any better solution out there?

In this specific case we want to get similar open incidents using "name" returning incidents ID and Labels.

Many thanks in advance.

Sebastien

Re: Using SearchIncidentsV2 or GetIncidentsByQuery in automations

gyldz — Mon, 31 Jul 2023 09:49:42 GMT

Hi @sdes ,

If you check SearchIncidentsV2 is also calling GetIncidentsByQuery script and you already made it work with GetIncidentsByQuery. We would advise to return only the required fields to save some resources. You can use populateFields option for this purpose. You can see the use of it below.

populate_fields = ["id", "labels"] res = demisto.executeCommand('GetIncidentsByQuery', { 'incidentTypes': "Cortex XDR Incident", 'populateFields': ' , '.join(populate_fields) }) if is_error(res): return_error(res) incidents = json.loads(res[0]['Contents']) demisto.results(incidents)

I hope this answers your question.

Re: Using SearchIncidentsV2 or GetIncidentsByQuery in automations

sdes — Mon, 31 Jul 2023 10:04:47 GMT

Hi @gyldz

Thank you for your swift reply. I suppose GetIncidentByQuery is the "go to" solution.

I will take note of the improvements you suggested.

Thanks again.

Best regards,

Sebastien