XSOAR 8 SearchIncidentsv2 script

[bridgetlitt]

When I use the XSOAR 8 SearchIncidentsv2 script with reason argument it return no results for example reason:False Positive returns nothing. Why is that? Is there some specific formatting to use?

[michaelsysec242]

 Have you tried to use !SearchIncidentsV2 query="closeReason:\"False Positive\"" from the CLI?

This will give you all the incidents with this closeReason within *limits. 

This should work for you unless you made a custom field called "reason".

If you want to run this from a task you don't need to escape the query: closeReason:"False Positive".

This will work. 

MSysec