In Linked Incidents, all owners should be the same

[YilmazDincer]

Hi all,

I want to assign all incidents that are Linkedincident to a single owner. What should I do for this?

I tried to assign with top-user,machine-learning parameters. But that didn't work.

[oromeromoya]

Hi YilmazDincer,

To assign all "linked" incidents to a specific owner in XSOAR, you can create a playbook or an automation script that searches for linked incidents and assigns them to the desired owner. Here is a sample script in Python you may customize according to your needs:

def main():
    # Define the owner to whom incidents will be assigned
    owner = 'specific-owner'  # Replace with the actual owner's username

    # Search for all linked incidents
    search_results = demisto.executeCommand('getIncidents', {
        'query': 'linked:true'
    })

    if not search_results or 'Contents' not in search_results[0]:
        demisto.results('No linked incidents found.')
        return

    incidents = search_results[0]['Contents']['data']

    # Assign each linked incident to the specified owner
    for incident in incidents:
        incident_id = incident['id']
        demisto.executeCommand('demisto-api-post', {
            'uri': f'incident/{incident_id}/owner',
            'body': {
                'owner': owner
            }
        })

    demisto.results(f'{len(incidents)} linked incidents assigned to {owner}.')

if __name__ in ('__main__', '__builtin__', 'builtins'):
    main()

[YilmazDincer]

Hi @oromeromoya

Thank you. I wanted to assign to the owner of the connected incident. So I give the id to 'SearchIncidentSummary'(linked incident's) and I take the owner and assign it to new incident. Thank you, I gained a different perspective.