How to Delete War Room Entries or Clear War Room

[michaelsysec242]

Hello LiveComm,

is there a way to remove an entry from an XSOAR incident ? This is needed for general entries and not just files as files can be deleted with Core API. An example of this can be a comment by an analyst or any textual entry. Perhaps the war room can be fully cleared ? I see that every entry has a URL but this does not work with the Delete Commands.

Many thanks,

MSys

Cortex XSOAR  

[gchawla]

Hi @michaelsysec242 As long as you are the owner/creator of an entry in the war room, you can edit and delete it.
If you edit an entry, the "History" button becomes available as well. For example, in the screenshot I edited my command entry to add "XYZ" to it and you can see the History button is available now.

Rest you can delete with the API.

Hope this helps.

   

[michaelsysec242]

Thanks for your reply, I want to do this programmatically and the API docs do not provide this feature. Please let me know if you found a different solution.