topic Re: Mass Closure of XSIAM Incidents in Cortex XSOAR Discussions

Mass Closure of XSIAM Incidents

Geyciane_Tavares — Wed, 23 Apr 2025 15:06:12 GMT

Hello team!
I would like to know if there is an option for mass closure of incidents in XSIAM.
I have the following scenario of 2000 open incidents and I would like to perform mass closure of these open cases. Is there any way to do this?

Re: Mass Closure of XSIAM Incidents

Ivetto — Thu, 05 Jun 2025 20:57:38 GMT

This is the XSOAR forum, please repost this in the XSIAM board: https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/bd-p/Cortex-XSIAM-Discussions

Re: Mass Closure of XSIAM Incidents

michaelsysec242 — Wed, 25 Jun 2025 11:30:38 GMT

@Geyciane_Tavares

Even though this is the wrong forum here is a solution you can resolve a large amount of case in bulk using the External API for the XSIAM.

Take note that the docs still use the terms 'Incident' and 'Alerts' but this works for cases and issues.

Make a script that gets all the incidents you want, extract the ID's into a list and then

for i in inc_id:

Update Alert:

status: resolved

Get Incidents (CASES)

Update Incidents (CASES)

Many thanks,

MichaelSysec242