Hi All,
Trying to write a script to help me close 10,000+ incidents automatically. Having issues with the actual patching stage.
Below is my code - eventually everything below the for loop will be included in the loop but just whilst testing it only patches one at a time.
I've also tried adding the snippet below but this didn't work either. I've been receiving either a 500 HTTP status code or "TypeError: 'Patch' object is not iterable". Any suggestions on how to go about doing this?
resolution_id = {
"name": "Escalated"
}
resolution_summary = {
"format": "text",
"content": "Closed in QRadar"
}
import datetime
import time
import resilient
import logging
import requests
import json as jsonlib
try:
userCredentials={
"email" : "",
"password" : '' }
newSession = requests.Session()
response = newSession.post('https://.com/rest/session',json=userCredentials,verify=False)
except Exception as e:
print("Error connecting to Resilient.")
print(repr(e))
time_from = datetime.datetime.now() - datetime.timedelta(days=7)
time_from = int(time_from.timestamp())
payload={
"filters": [
{
"conditions": [
{
"field_name":"create_date",
"method": "gt",
"value": time_from
},
{
"field_name":"plan_status",
"method": "equals",
"value": "A"
}
]
}
],
"sorts": [
{
"field_name": "create_date",
"type": "asc"
}
]
}
uri = "https://.com/rest/orgs/201/incidents/query_paged?field_handle=-1"
response = newSession.post(uri,json=payload,verify=False)
uri_closed = 'https://.com/rest/orgs/201/incidents/'
content = jsonlib.loads(response.content)
for x in content['data']:
url = "https://.com/rest/orgs/201/incidents/{}".format(x['id'])
data = newSession.get(url)
patch = resilient.Patch(data)
patch.add_value("plan_status", "C")
patch.add_value("resolution_id", 'Escalated')
patch.add_value("resolution_summary", 'Closed in QR')
result = newSession.patch(url, patch, overwrite_conflict=True)
------------------------------
Thanks,
Gareth
------------------------------