Link and Unlink incidents in the CLI - Administrator Guide - 6.9 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide
Product
Cortex XSOAR
Version
6.9
Creation date
2022-09-29
Last date published
2024-10-07
End_of_Life
EoL
Category
Administrator Guide
Abstract

Link and unlink incidents using the CLI in Cortex XSOAR.

You can link and unlink incidents in the CLI. The linked incidents appear in the Case Info tab.

  1. To link an incident, in the CLI, type the following command:

    !linkIncidents linkedIncidentIDs=<id> action=link

    Confirmation of the linked incident appears in the War Room and in the Case Info tab. In this example, we have linked the incident ID#3.

    linked-incident-war.png
    linked-incident-3.png

  2. To unlink the incident, type the following command:

    !linkIncidents linkedIncidentIDs=<id> action=unlink