Does XSOAR API Batch Close Incidents Endpoint Work?

cancel
Showing results for 
Search instead for 
Did you mean: 

Does XSOAR API Batch Close Incidents Endpoint Work?

L1 Bithead

I am attempting to close a single incident via the XSOAR API and the Batch Close Incidents endpoint (POST /incident/batchClose). The information about my request and the response are posted below. The status of the incident was new before I sent the close request and does not appear to have changed after sending the request even though the response status code is 200. The incident was not modified at all. What am I doing wrong?

 

POST https://xsoar.xyz.com/incident/batchClose
HTTP 200

Request Headers
Authorization: xxxxx
Content-Type: application/json
User-Agent: PostmanRuntime/7.28.0
Accept: */*
Host: xsoar.xyz.com
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 109

Request Body
{
"closeNotes": "TEST Close Notes",
"closeReason": "TEST Close Reason",
"filter": {"id": ["34595"]}
}

Response Headers
Content-Type: application/json
Server-Timing: 330
Strict-Transport-Security: max-age=10886400000000000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
Date: Wed, 22 Sep 2021 21:46:32 GMT
Transfer-Encoding: chunked

Response Body
{
"total": 1,
"data": [
{
"id": "34595",
"version": 4,
"modified": "2021-09-20T15:34:44.220359105-05:00",
"sortValues": null,
"roles": null,
"allRead": false,
"allReadWrite": false,
"previousRoles": null,
"previousAllRead": false,
"previousAllReadWrite": false,
"hasRole": false,
"dbotCreatedBy": "cdena",
"ShardID": 0,
"CustomFields": {
"actionsoncampaignincidents": "Close",
"csoctimer": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 0,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"csvdomain": [
{},
{},
{}
],
"dbotpredictionprobability": 0,
"detectionsla": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 20,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"endpoint": [
{}
],
"isactive": "true",
"qtemailsearchresults": [
{},
{},
{}
],
"qtipsearchresults": [
{},
{},
{}
],
"qturlsearchresults": [
{},
{},
{}
],
"remediationsla": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 7200,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"selectaction": "",
"similarincidentsdbot": [
{}
],
"splunkemailresults": [
{},
{},
{}
],
"timetoassignment": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 0,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"urlsslverification": []
},
"account": "",
"autime": 1632170083637240196,
"type": "No Playbook Developed",
"rawType": "No Playbook Developed",
"name": "XSOAR Integration Test",
"rawName": "XSOAR Integration Test",
"status": 1,
"reason": "",
"created": "2021-09-20T15:34:43.637240196-05:00",
"occurred": "2021-09-20T15:34:43.637239603-05:00",
"closed": "0001-01-01T00:00:00Z",
"sla": 0,
"severity": 0,
"investigationId": "34595",
"labels": [
{
"value": "cdena",
"type": "Instance"
},
{
"value": "Manual",
"type": "Brand"
}
],
"attachment": null,
"details": "",
"openDuration": 0,
"lastOpen": "0001-01-01T00:00:00Z",
"closingUserId": "",
"owner": "cdena",
"activated": "0001-01-01T00:00:00Z",
"closeReason": "",
"rawCloseReason": "",
"closeNotes": "",
"playbookId": "1321d4de-9f5f-4150-8e3e-01bf2e7b9799",
"dueDate": "2021-10-04T15:34:43.637240196-05:00",
"reminder": "0001-01-01T00:00:00Z",
"runStatus": "waiting",
"notifyTime": "2021-09-20T15:34:44.212182182-05:00",
"phase": "",
"rawPhase": "",
"isPlayground": false,
"rawJSON": "",
"parent": "",
"category": "",
"rawCategory": "",
"linkedIncidents": null,
"linkedCount": 0,
"droppedCount": 0,
"sourceInstance": "cdena",
"sourceBrand": "Manual",
"canvases": null,
"lastJobRunTime": "0001-01-01T00:00:00Z",
"feedBased": false,
"dbotMirrorId": "",
"dbotMirrorInstance": "",
"dbotMirrorDirection": "",
"dbotDirtyFields": null,
"dbotCurrentDirtyFields": null,
"dbotMirrorTags": null,
"dbotMirrorLastSync": "0001-01-01T00:00:00Z",
"isDebug": false,
"changeStatus": "",
"insights": 0
}
],
"notUpdated": 0,
"searchAfter": null,
"searchBefore": null,
"searchAfterElastic": null,
"searchBeforeElastic": null
}

1 REPLY 1

L2 Linker

Hi,
I would recommend you to open developer tools in your browser (F12) just before executing the batch close,
as a result you will see exactly how the request looks like when you do it manually in the UI,
Here is an Example (without the close reason and notes but with the other, mandatory fields):
POST /incident/batchClose
all: false
data: {}
filter: {page: 0, size: 50, query: "-status:closed -category:job", sort: [{field: "id", asc: false}],"period": {"by": "day","fromValue": 7}}
ids: ["4", "5"]

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!