error 'Missing required field: 'owner' when uploading / creating incident via json

[jboyd98]

Trying to export a ticket from PROD into DEV.

To test I exported a ticket in DEV as a json using this in the playground.

!azure-sentinel-get-incident-by-id incident_id="c5dc30e5-6981-4cb0-9895-66967fc3f2e9" raw-response="true"
(saved as json)

Then n DEV, i tried importing the json per the following instructions:

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar-admin/incidents/incident-mana...

It fails and I get this error:

error 'Missing required field: 'owner'

Without any modification the exported json had:

"owner": {
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
},

I tried modifying the json to the following, but both imports were unsuccessful:

"owner": {
"owner":"jboyd@x.onmicrosoft.com",
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
},

Does anyone have an example of one that works.  I don't understand why I can export to json in DEV and then import to DEV; i choose the correct mapping and automapped my fields.  Looks correct...

Thanks again,

Boyd

[cstone]

The issue is you have "owner": {

...

}

it should be like this: 
{
"owner":"jboyd@x.onmicrosoft.com",
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
}

[RahulVijaydev · Accepted solution]

Also, adding a note to the above response - The JSON you are attempting to use is the result of a command execution, not the structure the mapper is expecting. To easily obtain the JSON representation of an incident, you can use this URL https://hostname/incident/load/<incident_id>  for ex. https://hostname/incident/load/100.

Copy the json into a file, upload it into the mapper, map the fields and then create the incident.

[jboyd98]

Sorry my mappings have it under properties.owner.owner

[jboyd98]

Thank you both, got it!

[RahulVijaydev]

Awesome! Let us know if you need more help🙂

[jboyd98]

 https://hostname/incident/load/<incident_id>

Actually that didn't work for me; just confirming is that the correct syntax?

[RahulVijaydev]

Yup, it's this format - https://hostname/incident/load/100  where 100 is the incident id. Make sure to remove the pound sign from the url. 

[jboyd98]

Wierd
so this returns:  https://xx.xx.xx.xx/acc_CCDev01#/Custom/caseinfoid/863

https://xx.xx.xx.xx/incident/load/863

Returns

[jboyd98]

@RahulVijaydev 

Trying to get this to work, any advice.  Screenshot above, this command doesn't seem to be working, but it would make my life much easier if would work 🙂

 https://hostname/incident/load/<incident_id> 

Once I have that, should i be able to import using the upload json option to create the incident without any subsequent mapping?

[RahulVijaydev]

Are you on a multi-tenant instance? I can see *acc* in the URL. If so, the URL should be of this format https://xxx/acc_name/incident/load/<incident_id>