Batch delete incidents

Cortex XSOAR 6 API

post /incident/batchDelete

Deletes an incidents batch

CURL
curl -X POST \ -H "Authorization: [[apiKey]]" \ -H "Accept: application/json" \ -H "Content-Type: application/json,application/xml" \ "https://hostname:443/incident/batchDelete" \ -d '{ "all" : true, "filter" : { "parent" : [ "parent", "parent" ], "reason" : [ "reason", "reason" ], "notInvestigation" : [ "notInvestigation", "notInvestigation" ], "totalOnly" : true, "type" : [ "type", "type" ], "fromActivatedDate" : "2000-01-23T04:56:07.000+00:00", "notCategory" : [ "notCategory", "notCategory" ], "fromDateLicense" : "2000-01-23T04:56:07.000+00:00", "andOp" : true, "searchAfterElastic" : [ "searchAfterElastic", "searchAfterElastic" ], "searchBefore" : [ "searchBefore", "searchBefore" ], "details" : "details", "id" : [ "id", "id" ], "toActivatedDate" : "2000-01-23T04:56:07.000+00:00", "period" : { "fromValue" : "fromValue", "toValue" : "toValue", "byFrom" : "byFrom", "field" : "field", "by" : "by", "byTo" : "byTo" }, "searchAfterMapOrder" : { "key" : 6 }, "level" : [ 4, 4 ], "query" : "query", "notStatus" : [ 2, 2 ], "sort" : [ { "asc" : true, "field" : "field", "fieldType" : "fieldType" }, { "asc" : true, "field" : "field", "fieldType" : "fieldType" } ], "users" : [ "users", "users" ], "fromDate" : "2000-01-23T04:56:07.000+00:00", "size" : 1, "fromReminder" : "2000-01-23T04:56:07.000+00:00", "name" : [ "name", "name" ], "files" : [ "files", "files" ], "searchAfter" : [ "searchAfter", "searchAfter" ], "fromClosedDate" : "2000-01-23T04:56:07.000+00:00", "page" : 0, "fields" : [ "fields", "fields" ], "Cache" : { "key" : [ "Cache", "Cache" ] }, "status" : [ 2, 2 ], "ignoreWorkers" : true, "filterobjectquery" : "filterobjectquery", "urls" : [ "urls", "urls" ], "systems" : [ "systems", "systems" ], "includeTmp" : true, "toClosedDate" : "2000-01-23T04:56:07.000+00:00", "searchAfterMap" : { "key" : [ "searchAfterMap", "searchAfterMap" ] }, "toDueDate" : "2000-01-23T04:56:07.000+00:00", "fromDueDate" : "2000-01-23T04:56:07.000+00:00", "searchBeforeElastic" : [ "searchBeforeElastic", "searchBeforeElastic" ], "toDate" : "2000-01-23T04:56:07.000+00:00", "trim_events" : 5, "toReminder" : "2000-01-23T04:56:07.000+00:00", "timeFrame" : 5, "investigation" : [ "investigation", "investigation" ], "accounts" : { "key" : "{}" }, "category" : [ "category", "category" ] }, "CustomFields" : { "key" : "{}" }, "overrideInvestigation" : true, "closeNotes" : "closeNotes", "data" : { "key" : "{}" }, "columns" : [ "columns", "columns" ], "line" : "line", "ids" : [ "ids", "ids" ], "force" : true, "originalIncidentId" : "originalIncidentId", "closeReason" : "closeReason" }' \ -d ' UNDEFINED_EXAMPLE_VALUE true aeiou aeiou aeiou UNDEFINED_EXAMPLE_VALUE UNDEFINED_EXAMPLE_VALUE UNDEFINED_EXAMPLE_VALUE true aeiou
aeiou
aeiou aeiou aeiou 2000-01-23T04:56:07.000Z 2000-01-23T04:56:07.000Z 2000-01-23T04:56:07.000Z 2000-01-23T04:56:07.000Z 2000-01-23T04:56:07.000Z 2000-01-23T04:56:07.000Z aeiou true true aeiou aeiou aeiou aeiou 123456789 aeiou aeiou aeiou aeiou aeiou UNDEFINED_EXAMPLE_VALUE UNDEFINED_EXAMPLE_VALUE aeiou aeiou 123456789 aeiou 123456789 2000-01-23T04:56:07.000Z 2000-01-23T04:56:07.000Z 2000-01-23T04:56:07.000Z 2000-01-23T04:56:07.000Z 2000-01-23T04:56:07.000Z true 123456789 aeiou aeiou aeiou
true aeiou aeiou aeiou true
'
Authentication: api_key Api Key "Authorization"
Request
Body
optional
CustomFields
optional
Map of objects
all
optional
Boolean
closeNotes
optional
String
closeReason
optional
String
columns
optional
Array of strings
data
optional
Map of objects
filter
optional
Cache
optional
Map
Cache of join functions
accounts
optional
Map of objects
andOp
optional
Boolean
category
optional
Array of strings
details
optional
String
fields
optional
Array of strings
files
optional
Array of strings
filterobjectquery
optional
String
fromActivatedDate
optional
Object
format: date-time
fromClosedDate
optional
Object
format: date-time
fromDate
optional
Object
format: date-time
fromDateLicense
optional
Object
format: date-time
fromDueDate
optional
Object
format: date-time
fromReminder
optional
Object
format: date-time
id
optional
Array of strings
ignoreWorkers
optional
Boolean
Do not use workers mechanism while searching bleve
includeTmp
optional
Boolean
investigation
optional
Array of strings
level
optional
Array of numbers (Double)
format: double
name
optional
Array of strings
notCategory
optional
Array of strings
notInvestigation
optional
Array of strings
notStatus
optional
Array of numbers (Double)
format: double
page
optional
Number (Long)
0-based page format: int64
parent
optional
Array of strings
period
optional
by
optional
String
By is used for legacty, and if exists it will override ByTo and ByFrom
byFrom
optional
String
byTo
optional
String
field
optional
String
fromValue
optional
String
format: duration
toValue
optional
String
format: duration
query
optional
String
reason
optional
Array of strings
searchAfter
optional
Array of strings
Efficient next page, pass max sort value from previous page
searchAfterElastic
optional
Array of strings
Efficient next page, pass max ES sort value from previous page
searchAfterMap
optional
Map
Map accounts search after values - stores next page sort values per account. There is no need to store searchBeforeMap as [current page searchBefore] equals to [prev page searchAfter] More, there is no way to generate correct searchBefore from current page as some tenants may not appear at all. The map is relevant in proxy mode and used by tenants, each tenant extracts the searchAfter keys from the map.
searchAfterMapOrder
optional
Map of numbers (Long)
format: int64
searchBefore
optional
Array of strings
Efficient prev page, pass min sort value from next page
searchBeforeElastic
optional
Array of strings
Efficient prev page, pass min ES sort value from next page
size
optional
Number (Long)
Size is limited to 1000, if not passed it defaults to 0, and no results will return format: int64
sort
optional
Array
The sort order
Order struct holds a sort field and the direction of sorting
asc
optional
Boolean
field
optional
String
fieldType
optional
String
status
optional
Array of numbers (Double)
format: double
systems
optional
Array of strings
timeFrame
optional
Number (Long)
A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years. format: int64
toActivatedDate
optional
Object
format: date-time
toClosedDate
optional
Object
format: date-time
toDate
optional
Object
format: date-time
toDueDate
optional
Object
format: date-time
toReminder
optional
Object
format: date-time
totalOnly
optional
Boolean
trim_events
optional
Number (Long)
format: int64
type
optional
Array of strings
urls
optional
Array of strings
users
optional
Array of strings
force
optional
Boolean
ids
optional
Array of strings
line
optional
String
originalIncidentId
optional
String
overrideInvestigation
optional
Boolean
Responses

IncidentSearchResponseWrapper

Body
IncidentSearchResponseWrapper is an extension for the IncidentSearchResponse type, which holds list of IncidentWrapper(s)
accountErrors
optional
Array of strings
data
optional
Array
in: body
IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client
ShardID
optional
Number (Long)
format: int64
account
optional
String
Account holds the tenant name so that slicing and dicing on the master can leverage bleve
activated
optional
Object
When was this activated format: date-time
activatingingUserId
optional
String
The user that activated this investigation
allRead
optional
Boolean
allReadWrite
optional
Boolean
attachment
optional
Array
Attachments
description
optional
String
isTempPath
optional
Boolean
name
optional
String
path
optional
String
showMediaFile
optional
Boolean
type
optional
String
autime
optional
Number (Long)
AlmostUniqueTime is an attempt to have a unique sortable ID for an incident format: int64
cacheVersn
optional
Number (Long)
format: int64
canvases
optional
Array of strings
Canvases of the incident
category
optional
String
Category
changeStatus
optional
String
closeNotes
optional
String
Notes for closing the incident
closeReason
optional
String
The reason for closing the incident (select from existing predefined values)
closed
optional
Object
When was this closed format: date-time
closingUserId
optional
String
The user ID that closed this investigation
created
optional
Object
format: date-time
dbotCreatedBy
optional
String
Who has created this event - relevant only for manual incidents
dbotCurrentDirtyFields
optional
Array of strings
For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration
dbotDirtyFields
optional
Array of strings
For mirroring, manage a list of dirty fields to not override them from the source of the incident
dbotMirrorDirection
optional
String
DBotMirrorDirection of how to mirror the incident (in/out/both)
dbotMirrorId
optional
String
DBotMirrorID of a remote system we are syncing with
dbotMirrorInstance
optional
String
DBotMirrorInstance name of a mirror integration instance
dbotMirrorLastSync
optional
Object
The last time we synced this incident even if we did not update anything format: date-time
dbotMirrorTags
optional
Array of strings
The entry tags I want to sync to remote system
details
optional
String
The details of the incident - reason, etc.
droppedCount
optional
Number (Long)
DroppedCount ... format: int64
dueDate
optional
Object
SLA format: date-time
feedBased
optional
Boolean
If this incident was triggered by a feed job
hasRole
optional
Boolean
Internal field to make queries on role faster
highlight
optional
Map
id
optional
String
indexName
optional
String
insights
optional
Integer
format: uint64
investigationId
optional
String
Investigation that was opened as a result of the incoming event
isDebug
optional
Boolean
IsDebug ...
isPlayground
optional
Boolean
IsPlayGround
labels
optional
Array
Labels related to incident - each label is composed of a type and value
type
optional
String
value
optional
String
lastJobRunTime
optional
Object
If this incident was triggered by a job, this would be the time the previous job started format: date-time
lastOpen
optional
Object
format: date-time
linkedCount
optional
Number (Long)
LinkedCount ... format: int64
linkedIncidents
optional
Array of strings
LinkedIncidents incidents that were marked as linked by user
modified
optional
Object
format: date-time
name
optional
String
Incident Name - given by user
notifyTime
optional
Object
Incdicates when last this field was changed with a value that supposed to send a notification format: date-time
numericId
optional
Number (Long)
format: int64
occurred
optional
Object
When this incident has really occurred format: date-time
openDuration
optional
Number (Long)
Duration incident was open format: int64
owner
optional
String
The user who owns this incident
parent
optional
String
Parent
phase
optional
String
Phase
playbookId
optional
String
The associated playbook for this incident
previousAllRead
optional
Boolean
previousAllReadWrite
optional
Boolean
previousRoles
optional
Array of strings
Do not change this field manually
primaryTerm
optional
Number (Long)
format: int64
rawCategory
optional
String
rawCloseReason
optional
String
The reason for closing the incident (select from existing predefined values)
rawJSON
optional
String
rawName
optional
String
Incident RawName
rawPhase
optional
String
RawPhase
rawType
optional
String
Incident raw type
reason
optional
String
The reason for the resolve
reminder
optional
Object
When if at all to send a reminder format: date-time
roles
optional
Array of strings
The role assigned to this investigation
runStatus
optional
String
RunStatus of a job
sequenceNumber
optional
Number (Long)
format: int64
severity
optional
Number (Double)
Severity is the incident severity format: double
Example: 4
sizeInBytes
optional
Number (Long)
format: int64
sla
optional
Number (Double)
SLAState is the incident sla at closure time, in minutes. format: double
sortValues
optional
Array of strings
sourceBrand
optional
String
SourceBrand ...
sourceInstance
optional
String
SourceInstance ...
status
optional
Number (Double)
IncidentStatus is the status of the incident format: double
Example: 2
syncHash
optional
String
todoTaskIds
optional
Array of strings
ToDoTaskIDs list of to do task ids
type
optional
String
Incident type
version
optional
Number (Long)
format: int64
xsoarHasReadOnlyRole
optional
Boolean
xsoarPreviousReadOnlyRoles
optional
Array of strings
xsoarReadOnlyRoles
optional
Array of strings
notUpdated
optional
Integer
format: uint64
searchAfter
optional
Array of strings
searchAfterElastic
optional
Array of strings
searchBefore
optional
Array of strings
searchBeforeElastic
optional
Array of strings
total
optional
Number (Long)
format: int64
totalAccounts
optional
Number (Long)
format: int64