Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Who rated this post

You could export an existing incident and make the labels the main fields on the incident and use this JSON as a file input into the mapping.


For example, create an automation script called "exportIncidentLabels" and use the following code:


incident = demisto.incident().get('labels', {})
parsed_incident = dict()

for item in incident:
    parsed_incident[item['type']] = item['value']



Then execute it from the war room of the desired incident that contains the relevant labels. When the results show, download them as a file:









Then open the mapper and use:







However you get the data out, the mapper JSON input file expects a JSON list of dictionaries. Each array entry is considered a new incident and the JSON dictionary is considered the "rawJSON" input into an incident.




    "incident1_field1": "value1",

    "incident1_field2": "value2"



    "incident2_field1": "value1",

    "incident2_field2": "value2"




View solution in original post

Who rated this post