Is there a way to mass rename closed XSOAR cases?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Is there a way to mass rename closed XSOAR cases?

L1 Bithead

Hi, I know that we can mass rename active cases but what about mass renaming closed cases? I can rename closed cases one at a time manually but it is super tedious to do so as we have thousands of existing cases. Any suggestions? Thanks.

1 REPLY 1

L2 Linker

Hello @weijielim

 

You can change the name of a closed incident using the command !setIncident from a different incident, by passing the id of the incident you'd like to rename and the name you'd like to give to it. If you'd like to target multiple incidents at once you will need to wrap that command inside a for loop in an automation. 

You can use this basic automation below as an example:

import json

query = demisto.args()['query']
new_name = demisto.args()['new_name']

try:
    incidents = demisto.executeCommand('getIncidents', {'query': query, 'size': '10000'})[0]['Contents']['data']
    incident_ids = demisto.dt(incidents,'id')
except:
    demisto.results('No incidents found matching query.')
    sys.exit(0)

if not incidents:
    demisto.results('No closed incidents found matching query.')
    sys.exit(0)


res = []
for inc_id in incident_ids:
    try:
        command_res = demisto.executeCommand("setIncident", {'id': inc_id, 'name': new_name})[0]['Contents']
        if "Script failed" not in command_res:
            res.append({'Incident ID': inc_id, 'Status': "Success"})
        else:
            res.append({'Incident ID': inc_id, 'Status': "Failure"})
    except Exception as e:
        demisto.results(e)
        sys.exit(0)

demisto.results({'Type': entryTypes['note'],
    'ContentsFormat': formats['markdown'],
    'Contents': tableToMarkdown(name='Renamed Incidents', t=res)
})

 
This works for both Active and Closed incidents. 

  • 890 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!