Reopen XSOAR Incidents Bulk in XSOAR

michaelsysec242 — Wed, 21 Feb 2024 09:14:01 GMT

Hello all,

I need to reopen a large amount of incidents on Xsoar. Can anyone suggest how I can do this?

I have tried to run both the built-in command and the automation to reopen from the run command button with the bulk incidents selected but to no avail.

Many thanks,

Re: Reopen XSOAR Incidents Bulk in XSOAR

jqamruddin — Wed, 21 Feb 2024 16:32:20 GMT

Hi,

There are couple of ways you can do this:

Run !reopenInvestigation command in the incidents page after picking the incidents you open, I suggest doing in smaller batches. See attached screenshot for more clarification.
You can create a wrapper script that fetches the relevant closed investigations and run the command on them

Here is an example script to this by query:

queryid = demisto.getArg("query") if "status:closed" not in queryid.lower(): queryid += " and status:Closed" incs = demisto.executeCommand("getIncidents", {"query":queryid})[0]['Contents'] if incs['total'] == 0: demisto.results("Could not find incidents, please confirm query") sys.exit() listreopen = [i['investigationId'] for i in incs['data']] for incid in listreopen: demisto.executeCommand("reopenInvestigation", {"id":incid}) strlist = ",".join(listreopen) totalcount = len(listreopen) demisto.results(f"Done, reopened {totalcount} incidents: {strlist}")

Hope this helps!

topic Reopen XSOAR Incidents Bulk in XSOAR in Cortex XSOAR Discussions

Reopen XSOAR Incidents Bulk in XSOAR

Re: Reopen XSOAR Incidents Bulk in XSOAR