version must be updated.
External DocumentationTo learn more, visit the Palo Alto Cortex Xsoar documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Details | The details to set to the incident. |
| Name | The name of the incident to create or update. |
| Playbook ID | The associated Cortex XSOAR playbook for this incident. |
| Severity | The severity of the incident to create or update. Valid range is 0-4. |
| Status | The status of the incident. Valid range is 0-2. |
| Type | The type of the incident to create or update. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Close Notes | Closing notes to add to the incident. |
| Close Reason | The reason for closing the incident. Note: Use predefined closing reasons values. |
| Closed | The closing time to set to the incident. |
| Create Investigation | Select to start the investigation process automatically upon creating. |
| Custom Fields | A JSON object of incident fields to set. Important Notes: - Keys must be the field display names converted to lowercase with spaces removed (e.g., Scan IP → scanip).- If a custom field was created after the incident, it may not appear on that incident until you set a value or update it; ensure the field is associated with the incident type/layout. - Admins create and map incident fields (and add them to layouts) via Incident Fields settings. |
| Labels | An array of labels to add to the incident. For Example: |
| Modified | The closing time to set to the incident. |
| Raw JSON | A JSON object to add to the created or updated incident. |
| Reason | The reason for closing incident. |
| SLA | The incident SLA at closure time - in minutes. |
Example Output
Workflow Library Example
Create or Update Incident with Palo Alto Cortex Xsoar and Send Results Via Email