Trying to export a ticket from PROD into DEV. To test I exported a ticket in DEV as a json using this in the playground. !azure-sentinel-get-incident-by-id incident_id="c5dc30e5-6981-4cb0-9895-66967fc3f2e9" raw-response="true" (saved as json) Then n DEV, i tried importing the json per the following instructions: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar-admin/incidents/incident-management/create-an-incident.html It fails and I get this error: error 'Missing required field: 'owner' Without any modification the exported json had: "owner": { "assignedTo": "Joshua Boyd", "email": "soc@email.com", "objectId": null, "userPrincipalName": null }, I tried modifying the json to the following, but both imports were unsuccessful: "owner": { "owner":"jboyd@x.onmicrosoft.com", "assignedTo": "Joshua Boyd", "email": "soc@email.com", "objectId": null, "userPrincipalName": null }, Does anyone have an example of one that works. I don't understand why I can export to json in DEV and then import to DEV; i choose the correct mapping and automapped my fields. Looks correct... Thanks again, Boyd
... View more
