Does XSOAR API Batch Close Incidents Endpoint Work?

Snader — Thu, 23 Sep 2021 00:27:36 GMT

I am attempting to close a single incident via the XSOAR API and the Batch Close Incidents endpoint (POST /incident/batchClose). The information about my request and the response are posted below. The status of the incident was new before I sent the close request and does not appear to have changed after sending the request even though the response status code is 200. The incident was not modified at all. What am I doing wrong?

POST https://xsoar.xyz.com/incident/batchClose
HTTP 200

Request Headers
Authorization: xxxxx
Content-Type: application/json
User-Agent: PostmanRuntime/7.28.0
Accept: */*
Host: xsoar.xyz.com
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 109

Request Body
{
"closeNotes": "TEST Close Notes",
"closeReason": "TEST Close Reason",
"filter": {"id": ["34595"]}
}

Response Headers
Content-Type: application/json
Server-Timing: 330
Strict-Transport-Security: max-age=10886400000000000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
Date: Wed, 22 Sep 2021 21:46:32 GMT
Transfer-Encoding: chunked

Response Body
{
"total": 1,
"data": [
{
"id": "34595",
"version": 4,
"modified": "2021-09-20T15:34:44.220359105-05:00",
"sortValues": null,
"roles": null,
"allRead": false,
"allReadWrite": false,
"previousRoles": null,
"previousAllRead": false,
"previousAllReadWrite": false,
"hasRole": false,
"dbotCreatedBy": "cdena",
"ShardID": 0,
"CustomFields": {
"actionsoncampaignincidents": "Close",
"csoctimer": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 0,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"csvdomain": [
{},
{},
{}
],
"dbotpredictionprobability": 0,
"detectionsla": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 20,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"endpoint": [
{}
],
"isactive": "true",
"qtemailsearchresults": [
{},
{},
{}
],
"qtipsearchresults": [
{},
{},
{}
],
"qturlsearchresults": [
{},
{},
{}
],
"remediationsla": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 7200,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"selectaction": "",
"similarincidentsdbot": [
{}
],
"splunkemailresults": [
{},
{},
{}
],
"timetoassignment": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 0,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"urlsslverification": []
},
"account": "",
"autime": 1632170083637240196,
"type": "No Playbook Developed",
"rawType": "No Playbook Developed",
"name": "XSOAR Integration Test",
"rawName": "XSOAR Integration Test",
"status": 1,
"reason": "",
"created": "2021-09-20T15:34:43.637240196-05:00",
"occurred": "2021-09-20T15:34:43.637239603-05:00",
"closed": "0001-01-01T00:00:00Z",
"sla": 0,
"severity": 0,
"investigationId": "34595",
"labels": [
{
"value": "cdena",
"type": "Instance"
},
{
"value": "Manual",
"type": "Brand"
}
],
"attachment": null,
"details": "",
"openDuration": 0,
"lastOpen": "0001-01-01T00:00:00Z",
"closingUserId": "",
"owner": "cdena",
"activated": "0001-01-01T00:00:00Z",
"closeReason": "",
"rawCloseReason": "",
"closeNotes": "",
"playbookId": "1321d4de-9f5f-4150-8e3e-01bf2e7b9799",
"dueDate": "2021-10-04T15:34:43.637240196-05:00",
"reminder": "0001-01-01T00:00:00Z",
"runStatus": "waiting",
"notifyTime": "2021-09-20T15:34:44.212182182-05:00",
"phase": "",
"rawPhase": "",
"isPlayground": false,
"rawJSON": "",
"parent": "",
"category": "",
"rawCategory": "",
"linkedIncidents": null,
"linkedCount": 0,
"droppedCount": 0,
"sourceInstance": "cdena",
"sourceBrand": "Manual",
"canvases": null,
"lastJobRunTime": "0001-01-01T00:00:00Z",
"feedBased": false,
"dbotMirrorId": "",
"dbotMirrorInstance": "",
"dbotMirrorDirection": "",
"dbotDirtyFields": null,
"dbotCurrentDirtyFields": null,
"dbotMirrorTags": null,
"dbotMirrorLastSync": "0001-01-01T00:00:00Z",
"isDebug": false,
"changeStatus": "",
"insights": 0
}
],
"notUpdated": 0,
"searchAfter": null,
"searchBefore": null,
"searchAfterElastic": null,
"searchBeforeElastic": null
}

Re: Does XSOAR API Batch Close Incidents Endpoint Work?

gfilippov — Mon, 04 Oct 2021 22:19:57 GMT

Hi,
I would recommend you to open developer tools in your browser (F12) just before executing the batch close,
as a result you will see exactly how the request looks like when you do it manually in the UI,
Here is an Example (without the close reason and notes but with the other, mandatory fields):
POST /incident/batchClose
all: false
data: {}
filter: {page: 0, size: 50, query: "-status:closed -category:job", sort: [{field: "id", asc: false}],"period": {"by": "day","fromValue": 7}}
ids: ["4", "5"]

topic Does XSOAR API Batch Close Incidents Endpoint Work? in Cortex XSOAR Discussions

Does XSOAR API Batch Close Incidents Endpoint Work?

Re: Does XSOAR API Batch Close Incidents Endpoint Work?