Export incidents to an Excel or CSV file.
You can export one or more incidents to an Excel or CSV file.
If you want to export an incident as a JSON file, run the !js script="return ${.}" command in the War Room.
Note
When exporting an incident to a CSV format, Cortex XSOAR generates the report in UTF8 format. If you want to export an incident that contains Cyrillic characters, such as Russian and Greek, you need to change the format to UTF8-BOM.
Administrator permission is required to change server configurations, including the format. For more information, see Export an incident to CSV using the UTF8-BOM format.
The data does not include files, attachments, and artifacts. All text is plain text (there is no formatting).
Before you begin
Enable pop-ups from your Cortex XSOAR tenant.
Select which data appears in your exported file by adding columns to the incidents table. If a column is hidden, the data is not exported. You can hide, show, or reorder the columns in the table by using the settings icon on the Incidents page.
On the Incidents page, at the top of the incidents table, click the settings wheel to configure the columns to include for export.
Select the incidents to export, and click Export.
Select one of the following:
Summary Report (CSV file)
Detailed Report (Excel file)
You can export up to 1,000 incidents at a time. If the incidents you select contain more than 10,000 combined entries, an error appears and the file is not generated. The maximum file size for download is 100 MB.
Note
The date format displayed in the Excel/CSV file matches the timestamp format set by the user on the Server Settings page. If you haven't set a timestamp format, the default timestamp format is used.