Using SearchIncidentsV2 or GetIncidentsByQuery in automations

[sdes]

Hi,

First of all, we are using a lot of automations searching for incidents using queries often with more than 100 results.

The scripts line looks like this:

res = demisto.executeCommand('SearchIncidentsV2', {'query': query, 'limit': 5000})[0].get('Contents')

It seems however the "Content" only contains 100 results even though it shows the right number of incidents

 

To have access to the datas you have to add something like this too:

inc_data = res[0].get('Contents').get('data')

Still 100 results even with the limit higher

I, however, found that not using "Contents" but "EntryContext" provides everything, the script lines are a little bit more complex:

res = demisto.executeCommand('SearchIncidentsV2', {'query': query, 'limit': 5000})[0].get('EntryContext')

inc_data = res.get('foundIncidents(val.id && val.id == obj.id)'

 

 

 

This is not very clean.

The only solution we have so far is by using GetIncidentsByQuery as below:

res = json.loads(demisto.executeCommand('GetIncidentsByQuery', {'query': query, 'limit': 5000})[0].get('Contents'))

This is working perfectly

Is there any better solution out there?

In this specific case we want to get similar open incidents using "name" returning incidents ID and Labels.

Many thanks in advance.

Sebastien

[gyldz · Accepted solution]

Hi @sdes ,

If you check SearchIncidentsV2 is also calling GetIncidentsByQuery script and you already made it work with GetIncidentsByQuery. We would advise to return only the required fields to save some resources. You can use populateFields option for this purpose. You can see the use of it below.

populate_fields = ["id", "labels"]
res = demisto.executeCommand('GetIncidentsByQuery', {
        'incidentTypes': "Cortex XDR Incident",
        'populateFields': ' , '.join(populate_fields)
    })

if is_error(res):
   return_error(res)
incidents = json.loads(res[0]['Contents'])
demisto.results(incidents)

I hope this answers your question.

[sdes]

Hi @gyldz 

Thank you for your swift reply. I suppose GetIncidentByQuery is the "go to" solution.

I will take note of the improvements you suggested.

Thanks again.

Best regards,

Sebastien