https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/xsoar-8-searchincidentsv2-script/m-p/1225929#M3973 <P>When I use the&nbsp;XSOAR 8 SearchIncidentsv2 script with reason argument it return no results for example reason:False Positive returns nothing. Why is that? Is there some specific formatting to use?</P> Tue, 08 Apr 2025 09:11:56 GMT bridgetlitt 2025-04-08T09:11:56Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/xsoar-8-searchincidentsv2-script/m-p/1225929#M3973 <P>When I use the&nbsp;XSOAR 8 SearchIncidentsv2 script with reason argument it return no results for example reason:False Positive returns nothing. Why is that? Is there some specific formatting to use?</P> Tue, 08 Apr 2025 09:11:56 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/xsoar-8-searchincidentsv2-script/m-p/1225929#M3973 bridgetlitt 2025-04-08T09:11:56Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/xsoar-8-searchincidentsv2-script/m-p/1226965#M3988 <P>&nbsp;Have you tried to use !SearchIncidentsV2 query="closeReason:\"False Positive\"" from the CLI?</P> <P>This will give you all the incidents with this closeReason within *limits.&nbsp;</P> <P>This should work for you unless you made a custom field called "reason".</P> <P>If you want to run this from a task you don't need to escape the query:&nbsp;closeReason:"False Positive".</P> <P>This will work.&nbsp;</P> <P>MSysec</P> <P><LI-WRAPPER></LI-WRAPPER></P> Mon, 21 Apr 2025 10:46:32 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/xsoar-8-searchincidentsv2-script/m-p/1226965#M3988 michaelsysec242 2025-04-21T10:46:32Z