Reopen XSOAR Incidents Bulk in XSOAR

[michaelsysec242]

Hello all, 

I need to reopen a large amount of incidents on Xsoar. Can anyone suggest how I can do this? 

I have tried to run both the built-in command and the automation to reopen from the run command button with the bulk incidents selected but to no avail.

Many thanks,

MR 

Cortex XSOAR 

[jqamruddin]

 Hi, 

There are couple of ways you can do this: 

1. Run !reopenInvestigation command in the incidents page after picking the incidents you open, I suggest doing in smaller batches. See attached screenshot for more clarification.
2. You can create a wrapper script that fetches the relevant closed investigations and run the command on them

Here is an example script to this by query:

queryid = demisto.getArg("query")
if "status:closed" not in queryid.lower():
    queryid += " and status:Closed"
incs = demisto.executeCommand("getIncidents", {"query":queryid})[0]['Contents']
if incs['total'] == 0:
    demisto.results("Could not find incidents, please confirm query")
    sys.exit()
listreopen = [i['investigationId'] for i in incs['data']]
for incid in listreopen:
    demisto.executeCommand("reopenInvestigation", {"id":incid})
strlist = ",".join(listreopen)
totalcount = len(listreopen)
demisto.results(f"Done, reopened {totalcount} incidents: {strlist}")

Hope this helps!