> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents.md).

# Export incidents

You can do the following:

* Manually export one or more incidents from the Incidents table to an Excel or CSV file.
* Export, delete, or export and then delete incidents on a scheduled basis from Cortex XSOAR to external storage.

{% hint style="info" %}

### Note

Incidents cannot be imported back into Cortex XSOAR.
{% endhint %}

### **Export incidents from the Incidents table**

You can export one or more incidents to an Excel or CSV file.

If you want to export an incident as a JSON file, run the **`!js script="return ${.}"`** command in the War Room.

{% hint style="info" %}

### Note

When exporting an incident to a CSV format, Cortex XSOAR generates the report in UTF8 format. If you want to export an incident that contains Cyrillic characters, such as Russian and Greek, you need to change the format to UTF8-BOM.

Administrator permission is required to change server configurations, including the format. For more information, see [Export an incident to CSV using the UTF8-BOM format](/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/export-an-incident-to-csv-using-the-utf8-bom-format.md).
{% endhint %}

The data does not include files, attachments, and artifacts. All text is plain text (there is no formatting).

**Before you begin**

Enable pop-ups from your Cortex XSOAR tenant.

Select which data appears in your exported file by adding columns to the incidents table. If a column is hidden, the data is not exported. You can hide, show, or reorder the columns in the table by using the settings icon on the **Incidents** page.

1. On the **Incidents** page, at the top of the incidents table, click the settings wheel to configure the columns to include for export.
2. Select the incidents to export, and click **Export**.
3. Select one of the following:
   * **Summary Report** (CSV file)
   * **Detailed Report** (Excel file)

You can export up to 1,000 incidents at a time. If the incidents you select contain more than 10,000 combined entries, an error appears and the file is not generated. The maximum file size for download is 100 MB.

{% hint style="info" %}

### Note

* The date format displayed in the Excel/CSV file matches the timestamp format set by the user on the **Server Settings** page. If you haven't set a timestamp format, the default timestamp format is used.
* When exporting to a CSV file, field names are standardized as follows:

  * Any hyphens (-), underscores (\_), or periods (.) in a field name are replaced with a single space.
  * The string is converted to title case. For example, COLUMN TITLE becomes Column Title.
  * Words that are included in an internal predefined list of special terms, such as ID, SLA, ASN, IP, CVE, are not converted to title case and remain fully capitalized.

  If you require incident export to CSV format without standardization of field names, contact Customer Support.
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.