Who rated this post

You could export an existing incident and make the labels the main fields on the incident and use this JSON as a file input into the mapping.

For example, create an automation script called "exportIncidentLabels" and use the following code:

incident = demisto.incident().get('labels', {})
parsed_incident = dict()

for item in incident:
    parsed_incident[item['type']] = item['value']

demisto.results([json.dumps(parsed_incident)])

Then execute it from the war room of the desired incident that contains the relevant labels. When the results show, download them as a file:

Then open the mapper and use:

However you get the data out, the mapper JSON input file expects a JSON list of dictionaries. Each array entry is considered a new incident and the JSON dictionary is considered the "rawJSON" input into an incident.

[

{

    "incident1_field1": "value1",

    "incident1_field2": "value2"

},

{

    "incident2_field1": "value1",

    "incident2_field2": "value2"

}

]