Export multiple incidents to an Excel file.
You can export multiple incidents to an Excel (.XLSX) file. When incidents are exported, the spreadsheet contains the following tabs:
Incidents
Note
This tab contains incident fields that are displayed in the incidents table. If a column is hidden, the data is not exported. You can hide, show, or reorder the columns in the table by using the gear icon on the incidents page.
Notes
Chats
Evidence
Files and Attachments (file names and metadata only)
Manual Commands
The spreadsheet does not include:
Files, attachments, and artifacts
The Files and Attachments tab contains a list of files with the corresponding metadata, but the files themselves are not exported.
Formatting
All text is plain text.
As multiple incidents can be exported to the same spreadsheet, all entries in the spreadsheet are identified by incident ID.
You can export incidents from the Incidents page by selecting one or more incidents, clicking Export, and selecting Detailed Report Excel File. The file is downloaded automatically.
You can export up to 1,000 incidents at a time. If the incidents you select contain more than 10,000 combined entries, an error appears and the file is not generated. The maximum file size for download is 100 MB.
Note
The date format displayed in the Excel file matches the timestamp format set by the user in the Cortex XSOAR Server Settings. If the user requesting the download has not set a timestamp format, the default timestamp format is used.