topic error 'Missing required field: 'owner' when uploading / creating incident via json in Cortex XSOAR Discussions

error 'Missing required field: 'owner' when uploading / creating incident via json

jboyd98 — Mon, 04 Apr 2022 19:03:17 GMT

Trying to export a ticket from PROD into DEV.

To test I exported a ticket in DEV as a json using this in the playground.

!azure-sentinel-get-incident-by-id incident_id="c5dc30e5-6981-4cb0-9895-66967fc3f2e9" raw-response="true"
(saved as json)

Then n DEV, i tried importing the json per the following instructions:

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar-admin/incidents/incident-management/create-an-incident.html

It fails and I get this error:

error 'Missing required field: 'owner'

Without any modification the exported json had:

"owner": {
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
},

I tried modifying the json to the following, but both imports were unsuccessful:

"owner": {
"owner":"jboyd@x.onmicrosoft.com",
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
},

Does anyone have an example of one that works. I don't understand why I can export to json in DEV and then import to DEV; i choose the correct mapping and automapped my fields. Looks correct...

Thanks again,

Boyd

Re: error 'Missing required field: 'owner' when uploading / creating incident via json

cstone — Mon, 04 Apr 2022 19:16:20 GMT

The issue is you have "owner": {

...

}

it should be like this:
{
"owner":"jboyd@x.onmicrosoft.com",
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
}

Re: error 'Missing required field: 'owner' when uploading / creating incident via json

RahulVijaydev — Mon, 04 Apr 2022 19:20:59 GMT

Also, adding a note to the above response - The JSON you are attempting to use is the result of a command execution, not the structure the mapper is expecting. To easily obtain the JSON representation of an incident, you can use this URL https://hostname/incident/load/<incident_id> for ex. https://hostname/incident/load/100.

Copy the json into a file, upload it into the mapper, map the fields and then create the incident.

Re: error 'Missing required field: 'owner' when uploading / creating incident via json

jboyd98 — Mon, 04 Apr 2022 19:26:31 GMT

Sorry my mappings have it under properties.owner.owner

Re: error 'Missing required field: 'owner' when uploading / creating incident via json

jboyd98 — Mon, 04 Apr 2022 21:59:26 GMT

Thank you both, got it!

Re: error 'Missing required field: 'owner' when uploading / creating incident via json

RahulVijaydev — Mon, 04 Apr 2022 22:00:33 GMT

Awesome! Let us know if you need more help🙂

Re: error 'Missing required field: 'owner' when uploading / creating incident via json

jboyd98 — Mon, 04 Apr 2022 22:16:44 GMT

https://hostname/incident/load/<incident_id>

Actually that didn't work for me; just confirming is that the correct syntax?

Re: error 'Missing required field: 'owner' when uploading / creating incident via json

RahulVijaydev — Mon, 04 Apr 2022 22:19:22 GMT

Yup, it's this format - https://hostname/incident/load/100 where 100 is the incident id. Make sure to remove the pound sign from the url.

Re: error 'Missing required field: 'owner' when uploading / creating incident via json

jboyd98 — Mon, 04 Apr 2022 22:30:17 GMT

Wierd
so this returns: https://xx.xx.xx.xx/acc_CCDev01#/Custom/caseinfoid/863

https://xx.xx.xx.xx/incident/load/863

Returns

Re: error 'Missing required field: 'owner' when uploading / creating incident via json

jboyd98 — Wed, 06 Apr 2022 17:04:55 GMT

@RahulVijaydev

Trying to get this to work, any advice. Screenshot above, this command doesn't seem to be working, but it would make my life much easier if would work 🙂

https://hostname/incident/load/<incident_id>

Once I have that, should i be able to import using the upload json option to create the incident without any subsequent mapping?

Re: error 'Missing required field: 'owner' when uploading / creating incident via json

RahulVijaydev — Wed, 06 Apr 2022 17:25:10 GMT

Are you on a multi-tenant instance? I can see *acc* in the URL. If so, the URL should be of this format https://xxx/acc_name/incident/load/<incident_id>