04-04-2022 12:02 PM - edited 04-04-2022 12:03 PM
Trying to export a ticket from PROD into DEV.
To test I exported a ticket in DEV as a json using this in the playground.
!azure-sentinel-get-incident-by-id incident_id="c5dc30e5-6981-4cb0-9895-66967fc3f2e9" raw-response="true"
(saved as json)
Then n DEV, i tried importing the json per the following instructions:
It fails and I get this error:
error 'Missing required field: 'owner'
Without any modification the exported json had:
"owner": {
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
},
I tried modifying the json to the following, but both imports were unsuccessful:
"owner": {
"owner":"jboyd@x.onmicrosoft.com",
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
},
Does anyone have an example of one that works. I don't understand why I can export to json in DEV and then import to DEV; i choose the correct mapping and automapped my fields. Looks correct...
Thanks again,
Boyd
04-04-2022 12:20 PM - edited 04-04-2022 12:20 PM
Also, adding a note to the above response - The JSON you are attempting to use is the result of a command execution, not the structure the mapper is expecting. To easily obtain the JSON representation of an incident, you can use this URL https://hostname/incident/load/<incident_id> for ex. https://hostname/incident/load/100.
Copy the json into a file, upload it into the mapper, map the fields and then create the incident.
04-04-2022 12:16 PM
The issue is you have "owner": {
...
}
it should be like this:
{
"owner":"jboyd@x.onmicrosoft.com",
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
}
04-04-2022 12:20 PM - edited 04-04-2022 12:20 PM
Also, adding a note to the above response - The JSON you are attempting to use is the result of a command execution, not the structure the mapper is expecting. To easily obtain the JSON representation of an incident, you can use this URL https://hostname/incident/load/<incident_id> for ex. https://hostname/incident/load/100.
Copy the json into a file, upload it into the mapper, map the fields and then create the incident.
04-04-2022 12:26 PM
Sorry my mappings have it under properties.owner.owner
04-04-2022 02:59 PM
Thank you both, got it!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!