https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/how-to-copy-incident-files-from-linked-incidents/m-p/997681#M3798 <P>Hello Live Community,</P> <P>I am working on a use-case that requires me to copy incident files of any kind from within linked incidents and copy them to the main incident to be saved as evidence. I have tried the getentries command but an entryID does not suffice as the physical file is not copied t my incident. Does anyone have an idea on how to do this?&nbsp;</P> <P>Many thanks,</P> <P>MR</P> <P>#XSOAR</P> Wed, 11 Dec 2024 10:22:09 GMT michaelsysec242 2024-12-11T10:22:09Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/how-to-copy-incident-files-from-linked-incidents/m-p/997681#M3798 <P>Hello Live Community,</P> <P>I am working on a use-case that requires me to copy incident files of any kind from within linked incidents and copy them to the main incident to be saved as evidence. I have tried the getentries command but an entryID does not suffice as the physical file is not copied t my incident. Does anyone have an idea on how to do this?&nbsp;</P> <P>Many thanks,</P> <P>MR</P> <P>#XSOAR</P> Wed, 11 Dec 2024 10:22:09 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/how-to-copy-incident-files-from-linked-incidents/m-p/997681#M3798 michaelsysec242 2024-12-11T10:22:09Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/how-to-copy-incident-files-from-linked-incidents/m-p/997683#M3799 <P>Hi,</P> <P>You can upload using Core Rest API integration, command "core-api-upload" which has arguments entryid, incidentid.</P> Wed, 11 Dec 2024 10:43:24 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/how-to-copy-incident-files-from-linked-incidents/m-p/997683#M3799 sua 2024-12-11T10:43:24Z