Mass Closure of XSIAM Incidents

[Geyciane_Tavares]

Hello team!
I would like to know if there is an option for mass closure of incidents in XSIAM.
I have the following scenario of 2000 open incidents and I would like to perform mass closure of these open cases. Is there any way to do this?

[Ivetto]

This is the XSOAR forum, please repost this in the XSIAM board: https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/bd-p/Cortex-XSIAM-Discussions

[michaelsysec242]

@Geyciane_Tavares 

Even though this is the wrong forum here is a solution you can resolve a large amount of case in bulk using the External API for the XSIAM. 

Take note that the docs still use the terms 'Incident' and 'Alerts' but this works for cases and issues.

Make a script that gets all the incidents you want, extract the ID's into a list and then 

for i in inc_id:

    Update Alert: 

          status: resolved

Get Incidents (CASES) 

Update Incidents (CASES) 

Many thanks, 

MichaelSysec242