error 'Missing required field: 'owner' when uploading / creating incident via json

[jboyd98]

Trying to export a ticket from PROD into DEV.

To test I exported a ticket in DEV as a json using this in the playground.

!azure-sentinel-get-incident-by-id incident_id="c5dc30e5-6981-4cb0-9895-66967fc3f2e9" raw-response="true"
(saved as json)

Then n DEV, i tried importing the json per the following instructions:

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar-admin/incidents/incident-mana...

It fails and I get this error:

error 'Missing required field: 'owner'

Without any modification the exported json had:

"owner": {
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
},

I tried modifying the json to the following, but both imports were unsuccessful:

"owner": {
"owner":"jboyd@x.onmicrosoft.com",
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
},

Does anyone have an example of one that works.  I don't understand why I can export to json in DEV and then import to DEV; i choose the correct mapping and automapped my fields.  Looks correct...

Thanks again,

Boyd

[cstone]

The issue is you have "owner": {

...

}

it should be like this: 
{
"owner":"jboyd@x.onmicrosoft.com",
"assignedTo": "Joshua Boyd",
"email": "soc@email.com",
"objectId": null,
"userPrincipalName": null
}

[RahulVijaydev · Accepted solution]

Also, adding a note to the above response - The JSON you are attempting to use is the result of a command execution, not the structure the mapper is expecting. To easily obtain the JSON representation of an incident, you can use this URL https://hostname/incident/load/<incident_id>  for ex. https://hostname/incident/load/100.

Copy the json into a file, upload it into the mapper, map the fields and then create the incident.

[jboyd98]

Sorry my mappings have it under properties.owner.owner

[jboyd98]

Thank you both, got it!