Reopen selected incidents in "Investigation" tab

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Reopen selected incidents in "Investigation" tab

L4 Transporter

Hello,

I'd like to reopen the incidents selected after a query in Search Incidents. Not the result of the query, only the selected ones after the query, I'm trying to use the API commando to open them:

 

body = {"id":f"{incident}","version":version}
uri = f"/investigation/{incident}/reopen"
status = demisto.internalHttpRequest('POST', uri, body=body)

Of course, incident is closed so I can't use this call:

incident = demisto.incidents()[0].get('id')

 

How can I get the internal id variable of the selected incidents without query them? 

Josep_0-1680255394333.png

 

 

 

1 REPLY 1

L2 Linker

Hi @Josep , I have been testing our API recently (tested on both PowerShell and Python), and I was able to reopen closed incidents using the following steps:

 

1.) Search for the closed incidents you want to reopen using the /incidents/search API endpoint (save these results to a variable)

2.) Add each of the incidents returned from the query (the incident JSON data) into a list

3.) Loop through the list and set the uri with an f string with the incident["id"] value (almost exactly as you had before, except we are accessing the id property

4.) Within the loop, change the incident["version"] value to -1

5.) Run the demisto.internalHttpRequest Method inside of the loop using the following: status = demisto.internalHttpRequest('POST', uri, body=incident)

 

So everything will look like this after you have already searched for the closed incidents and looped through the incidents and added them to a list called "incidents_list" in this example:

 

for incident in incidents_list:

    incident["version"] = -1

    uri = f"/investigation/{incident["id"]}/reopen"

    status = demisto.internalHttpRequest("POST", uri=uri, body=incident)

 

Could you please give this a try and report back? Thank you.

 

 

  • 1372 Views
  • 1 replies
  • 0 Likes
  • 31 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!