SearchIncidentsSummary
Searches Cortex XSOAR Incidents and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument. Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument. This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchIncidentsV2 from the Common Scripts pack, but more efficient.
python · Common Scripts
Details
| ID | SearchIncidentsSummary |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Tags | Utility |
README
Searches Cortex XSOAR Incidents. Default search range is the last 30 days, if you want to change this, use the fromDate argument.
Returns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument.
This automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchIncidentsV2 from the Common Scripts pack, but more efficient.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | Utility |
Inputs
| Argument Name | Description |
|---|---|
| id | A comma-separated list of incident IDs by which to filter the results. |
| name | A comma-separated list of incident names by which to filter the results. |
| status | A comma-separated list of incident statuses by which to filter the results. For example: assigned. |
| notstatus | A comma-separated list of incident statuses to exclude from the results. For example: assigned. |
| reason | A comma-separated list of incident close reasons by which to filter the results. |
| fromdate | Filter by from date (e.g. “3 days ago” or 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z), default is “30 days ago” |
| todate | Filter by to date (e.g. “3 days ago” or 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z) |
| fromclosedate | Filter by from close date (e.g. 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z) |
| toclosedate | Filter by to close date (e.g. 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z) |
| fromduedate | Filter by from due date (e.g. 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z) |
| toduedate | Filter by to due date (e.g. 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z) |
| level | Filter by Severity |
| owner | Filter by incident owners |
| details | Filter by incident details |
| type | Filter by incident type |
| query | Use free form query (use Lucene syntax) as filter. All other filters will be ignored when this filter is used. |
| page | Filter by the page number |
| trimevents | The number of events to return from the alert JSON. The default is 0, which returns all events. Note that the count is from the head of the list, regardless of event time or other properties. |
| size | Number of incidents per page (per fetch) |
| sort | Sort in format of field.asc,field.desc,… |
| searchresultslabel | If provided, the value of this argument will be set under the searchResultsLabel context key for each incident found. |
| add_fields_to_context | A comma seperated list of fields to return to the context, (default: id,name,type,severity,status,owner,created,closed) |
Outputs
| Path | Description | Type |
|---|---|---|
| foundIncidents.id | A list of incident IDs returned from the query. | Unknown |
| foundIncidents.name | A list of incident names returned from the query. | Unknown |
| foundIncidents.severity | A list of incident severities returned from the query. | Unknown |
| foundIncidents.status | A list of incident statuses returned from the query. | Unknown |
| foundIncidents.owner | A list of incident owners returned from the query. | Unknown |
| foundIncidents.created | A list of the incident create date returned from the query. | Unknown |
| foundIncidents.closed | A list of incident close dates returned from the query. | Unknown |
| foundIncidents.incidentLink | A list with links to the incidents returned from the query. | Unknown |
| foundIncidents.searchResultsLabel | The value provided in the searchresultslabel argument. | String |
args: - default: true description: A comma-separated list of incident IDs by which to filter the results. isArray: true name: id - description: A comma-separated list of incident names by which to filter the results. isArray: true name: name - description: 'A comma-separated list of incident statuses by which to filter the results. For example: assigned.' isArray: true name: status - description: 'A comma-separated list of incident statuses to exclude from the results. For example: assigned.' isArray: true name: notstatus - description: A comma-separated list of incident close reasons by which to filter the results. isArray: true name: reason - defaultValue: 30 days ago description: Filter by from date (e.g. "3 days ago" or 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z), default is "30 days ago". name: fromdate - description: Filter by to date (e.g. "3 days ago" or 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z). name: todate - description: Filter by from close date (e.g. 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z). name: fromclosedate - description: Filter by to close date (e.g. 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z). name: toclosedate - description: Filter by from due date (e.g. 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z). name: fromduedate - description: Filter by to due date (e.g. 2006-01-02T15:04:05+07:00 or 2006-01-02T15:04:05Z). name: toduedate - description: Filter by Severity. isArray: true name: level - description: Filter by incident owners. isArray: true name: owner - description: Filter by incident details. name: details - description: Filter by incident type. isArray: true name: type - description: Use free form query (use Lucene syntax) as filter. All other filters will be ignored when this filter is used. name: query - description: Filter by the page number. name: page - defaultValue: "0" description: |- The number of events to return from the alert JSON. The default is 0, which returns all events. Note that the count is from the head of the list, regardless of event time or other properties. name: trimevents - description: Number of incidents per page (per fetch). name: size - description: Sort in format of field.asc,field.desc,... name: sort - description: If provided, the value of this argument will be set under the searchResultsLabel context key for each incident found. name: searchresultslabel - description: 'A comma seperated list of fields to return to the context, (default: id,name,type,severity,status,owner,created,closed).' name: add_fields_to_context comment: "Searches Cortex XSOAR Incidents and returnrs the most relevant fields. Default search range is the last 30 days, if you want to change this, use the fromDate argument. \n\nReturns the id, name, type, severity, status, owner, and created/closed times to context. You can add additional fields using the add_field_to_context argument.\n\nThis automation runs using the default Limited User role, unless you explicitly change the permissions. Based on the SearchIncidentsV2 from the Common Scripts pack, but more efficient." commonfields: id: SearchIncidentsSummary version: -1 contentitemexportablefields: contentitemfields: fromServerVersion: "" dockerimage: demisto/python3:3.12.13.10404775 enabled: true name: SearchIncidentsSummary outputs: - contextPath: foundIncidents.id description: A list of incident IDs returned from the query. type: Unknown - contextPath: foundIncidents.name description: A list of incident names returned from the query. type: Unknown - contextPath: foundIncidents.severity description: A list of incident severities returned from the query. type: Unknown - contextPath: foundIncidents.status description: A list of incident statuses returned from the query. type: Unknown - contextPath: foundIncidents.owner description: A list of incident owners returned from the query. type: Unknown - contextPath: foundIncidents.created description: A list of the incident create date returned from the query. type: Unknown - contextPath: foundIncidents.closed description: A list of incident close dates returned from the query. type: Unknown - contextPath: foundIncidents.incidentLink description: A list with links to the incidents returned from the query. type: Unknown - contextPath: foundIncidents.searchResultsLabel description: The value provided in the searchresultslabel argument. type: String runas: DBotWeakRole script: '' scripttarget: 0 subtype: python3 tags: - Utility type: python fromversion: 6.0.0 tests: - No tests (auto formatted)