topic Re: In Linked Incidents, all owners should be the same in Cortex XSOAR Discussions

In Linked Incidents, all owners should be the same

YilmazDincer — Wed, 31 Jul 2024 14:58:43 GMT

Hi all,

I want to assign all incidents that are Linkedincident to a single owner. What should I do for this?

I tried to assign with top-user,machine-learning parameters. But that didn't work.

Re: In Linked Incidents, all owners should be the same

oromeromoya — Thu, 01 Aug 2024 22:06:17 GMT

To assign all "linked" incidents to a specific owner in XSOAR, you can create a playbook or an automation script that searches for linked incidents and assigns them to the desired owner. Here is a sample script in Python you may customize according to your needs:

def main(): # Define the owner to whom incidents will be assigned owner = 'specific-owner' # Replace with the actual owner's username # Search for all linked incidents search_results = demisto.executeCommand('getIncidents', { 'query': 'linked:true' }) if not search_results or 'Contents' not in search_results[0]: demisto.results('No linked incidents found.') return incidents = search_results[0]['Contents']['data'] # Assign each linked incident to the specified owner for incident in incidents: incident_id = incident['id'] demisto.executeCommand('demisto-api-post', { 'uri': f'incident/{incident_id}/owner', 'body': { 'owner': owner } }) demisto.results(f'{len(incidents)} linked incidents assigned to {owner}.') if __name__ in ('__main__', '__builtin__', 'builtins'): main()

Re: In Linked Incidents, all owners should be the same

YilmazDincer — Fri, 02 Aug 2024 07:31:11 GMT

Hi @oromeromoya

Thank you. I wanted to assign to the owner of the connected incident. So I give the id to 'SearchIncidentSummary'(linked incident's) and I take the owner and assign it to new incident. Thank you, I gained a different perspective.