Link and Unlink Incidents in the CLI - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide
Product
Cortex XSOAR
Version
8
Creation date
2024-02-14
Last date published
2024-04-25
Category
Administrator Guide
Solution
Cloud
Abstract

Link and unlink incidents using the CLI in Cortex XSOAR .

You can link and unlink incidents in the CLI. The linked incidents appear in the Incident Info tab.

  1. To link an incident in the CLI, type the following command:

    !linkIncidents linkedIncidentIDs=<id> action=link

    Confirmation of the linked incident appears in the War Room and in the Case Info tab. In this example, we have linked the incident ID#3.

    linked-incident-war.png
    linked-incident-3.png

  2. To unlink the incident, type the following command:

    !linkIncidents linkedIncidentIDs=<id> action=unlink