Export incidents from the Incidents table

Export incidents from the Incidents table as Excel, CSV, or JSON files in Cortex XSOAR 8.10 On-prem.

Export one or more Cortex XSOAR incidents from the Incidents table. Choose an Excel or CSV report.

To export an incident as JSON, run !js script="return ${.}" in the War Room.

CSV reports use UTF8 encoding. Use UTF8-BOM for incidents containing Cyrillic characters, including Russian and Greek.

Changing this server setting requires Administrator permission. For more information, see Export an incident to CSV using the UTF8-BOM format.

Exported incident data excludes files, attachments, and artifacts. All exported text is plain text.

Before you begin

Enable pop-ups for your Cortex XSOAR 8 On-prem tenant.

Add columns to the Incidents table to control the exported data. Hidden columns are excluded. Use the settings icon on the Incidents page to show, hide, or reorder columns.

Export incidents to Excel or CSV

1. On the Incidents page, click the settings wheel above the incidents table. Configure the columns to export.
2. Select the incidents to export, and click Export.
3. Select one of the following:

   • Summary Report (CSV file)
   • Detailed Report (Excel file)

Incident export limits

Export up to 1,000 incidents at once. Exports fail when selected incidents exceed 10,000 combined entries. Downloaded files cannot exceed 100 MB.

• Excel and CSV dates use your Server Settings timestamp format. Cortex XSOAR uses the default timestamp format when none is configured.
• When exporting to a CSV file, field names are standardized as follows:

  • Hyphens (-), underscores (_), and periods (.) become a single space.
  • Field names use title case. For example, COLUMN TITLE becomes Column Title.
  • Special terms, including ID, SLA, ASN, IP, and CVE, remain capitalized.

  Contact Customer Support to export CSV files without field name standardization.