In Linked Incidents, all owners should be the same

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

In Linked Incidents, all owners should be the same

L3 Networker

Hi all,

 

I want to assign all incidents that are Linkedincident to a single owner. What should I do for this?

 

I tried to assign with top-user,machine-learning parameters. But that didn't work.

 

2 REPLIES 2

L1 Bithead

Hi YilmazDincer,

To assign all "linked" incidents to a specific owner in XSOAR, you can create a playbook or an automation script that searches for linked incidents and assigns them to the desired owner. Here is a sample script in Python you may customize according to your needs:

def main():
    # Define the owner to whom incidents will be assigned
    owner = 'specific-owner'  # Replace with the actual owner's username

    # Search for all linked incidents
    search_results = demisto.executeCommand('getIncidents', {
        'query': 'linked:true'
    })

    if not search_results or 'Contents' not in search_results[0]:
        demisto.results('No linked incidents found.')
        return

    incidents = search_results[0]['Contents']['data']

    # Assign each linked incident to the specified owner
    for incident in incidents:
        incident_id = incident['id']
        demisto.executeCommand('demisto-api-post', {
            'uri': f'incident/{incident_id}/owner',
            'body': {
                'owner': owner
            }
        })

    demisto.results(f'{len(incidents)} linked incidents assigned to {owner}.')

if __name__ in ('__main__', '__builtin__', 'builtins'):
    main()

Hi @oromeromoya

Thank you. I wanted to assign to the owner of the connected incident. So I give the id to 'SearchIncidentSummary'(linked incident's) and I take the owner and assign it to new incident. Thank you, I gained a different perspective.

  • 435 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!