Is there a way to mass rename closed XSOAR cases?

[weijielim]

Hi, I know that we can mass rename active cases but what about mass renaming closed cases? I can rename closed cases one at a time manually but it is super tedious to do so as we have thousands of existing cases. Any suggestions? Thanks.

[AbelSantamarina]

Hello @weijielim, 

You can change the name of a closed incident using the command !setIncident from a different incident, by passing the id of the incident you'd like to rename and the name you'd like to give to it. If you'd like to target multiple incidents at once you will need to wrap that command inside a for loop in an automation. 

You can use this basic automation below as an example:

import json

query = demisto.args()['query']
new_name = demisto.args()['new_name']

try:
    incidents = demisto.executeCommand('getIncidents', {'query': query, 'size': '10000'})[0]['Contents']['data']
    incident_ids = demisto.dt(incidents,'id')
except:
    demisto.results('No incidents found matching query.')
    sys.exit(0)

if not incidents:
    demisto.results('No closed incidents found matching query.')
    sys.exit(0)


res = []
for inc_id in incident_ids:
    try:
        command_res = demisto.executeCommand("setIncident", {'id': inc_id, 'name': new_name})[0]['Contents']
        if "Script failed" not in command_res:
            res.append({'Incident ID': inc_id, 'Status': "Success"})
        else:
            res.append({'Incident ID': inc_id, 'Status': "Failure"})
    except Exception as e:
        demisto.results(e)
        sys.exit(0)

demisto.results({'Type': entryTypes['note'],
    'ContentsFormat': formats['markdown'],
    'Contents': tableToMarkdown(name='Renamed Incidents', t=res)
})

 
This works for both Active and Closed incidents.