Export Incidents to Excel - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

Export multiple incidents to an Excel file.

You can export multiple incidents to an Excel (.XLSX) file. When incidents are exported, the spreadsheet contains the following tabs:

  • Incidents


    This tab contains incident fields that are displayed in the incidents table. If a column is hidden, the data is not exported. You can hide, show, or reorder the columns in the table by using the gear icon on the incidents page.

  • Notes

  • Chats

  • Evidence

  • Files and Attachments (file names and metadata only)

  • Manual Commands

The spreadsheet does not include:

  • Files, attachments, and artifacts

    The Files and Attachments tab contains a list of files with the corresponding metadata, but the files themselves are not exported.

  • Formatting

    All text is plain text.

As multiple incidents can be exported to the same spreadsheet, all entries in the spreadsheet are identified by incident ID.

You can export incidents from the Incidents page by selecting one or more incidents, clicking Export, and selecting Detailed Report Excel File. The file is downloaded automatically.

You can export up to 1,000 incidents at a time. If the incidents you select contain more than 10,000 combined entries, an error appears and the file is not generated. The maximum file size for download is 100 MB.


The date format displayed in the Excel file matches the timestamp format set by the user in the Cortex XSOAR Server Settings. If the user requesting the download has not set a timestamp format, the default timestamp format is used.