Storing Incident Notes in Context Data

[michaelsysec242]

Hello all,

I am working on a use-case in which I need to store text based comments (Including MD) to context data for report generation. I have tried to create a script for this yet I have not succeeded. Is there a way to access the comment section in order to pull comments dynamically ?

Cortex XSOAR 

[AbelSantamarina · Accepted solution]

@michaelsysec242, 

To get a specific comment from your incident you can use the built-in automation commentsToContext which takes as arguments the entryId of the comment and contextKey, which defines where to store the result in context. This works for individual comments, but not for all the comments in your investigation. 

To pull all the comments from your investigation, you can use in your automation the built-in command getEntries to get all the entries in your war-room in combination with a category filter for chat entries (see the documentation here.)

res = execute_command("getEntries", {"filter": {"categories": ["chats"]}})

Once you have all your chat entries (comments), you can save them to context and/or output them as a table.
Find below a simple script to get all the comments and save them to your context data.

[michaelsysec242]

@AbelSantamarina , 

thanks this works very well.

Cheers!