Reopen XSOAR Incidents Bulk in XSOAR

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Reopen XSOAR Incidents Bulk in XSOAR

L0 Member

Hello all, 

I need to reopen a large amount of incidents on Xsoar. Can anyone suggest how I can do this? 

I have tried to run both the built-in command and the automation to reopen from the run command button with the bulk incidents selected but to no avail.

Many thanks,


Cortex XSOAR 


L2 Linker



There are couple of ways you can do this: 

  1. Run !reopenInvestigation command in the incidents page after picking the incidents you open, I suggest doing in smaller batches. See attached screenshot for more clarification.
  2. You can create a wrapper script that fetches the relevant closed investigations and run the command on them

Here is an example script to this by query:

queryid = demisto.getArg("query")
if "status:closed" not in queryid.lower():
    queryid += " and status:Closed"
incs = demisto.executeCommand("getIncidents", {"query":queryid})[0]['Contents']
if incs['total'] == 0:
    demisto.results("Could not find incidents, please confirm query")
listreopen = [i['investigationId'] for i in incs['data']]
for incid in listreopen:
    demisto.executeCommand("reopenInvestigation", {"id":incid})
strlist = ",".join(listreopen)
totalcount = len(listreopen)
demisto.results(f"Done, reopened {totalcount} incidents: {strlist}")


Hope this helps!

  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!