Export incidents from the Incidents table

Export selected Cortex XSOAR 8 SaaS incidents to CSV or Excel files.

Export selected Cortex XSOAR incidents from the Incidents table to a CSV or Excel file. Use exports to share incident data outside Cortex XSOAR.

If you want to export an incident as a JSON file, run the !js script="return ${.}" command in the War Room.

When exporting an incident to a CSV format, Cortex XSOAR generates the report in UTF8 format. If you want to export an incident that contains Cyrillic characters, such as Russian and Greek, you need to change the format to UTF8-BOM.

Administrator permission is required to change server configurations, including the format. For more information, see Export an incident to CSV using the UTF8-BOM format.

Exported data does not include files, attachments, or artifacts. All exported text is plain text.

Before you begin

Enable pop-ups from your Cortex XSOAR 8 SaaS tenant.

Select which data appears in your exported file by adding columns to the incidents table. If a column is hidden, the data is not exported. You can hide, show, or reorder the columns in the table by using the settings icon on the Incidents page.

Export incidents to Excel or CSV

1. On the Incidents page, at the top of the incidents table, click the settings wheel to configure the columns to include for export.
2. Select the incidents to export, and click Export.
3. Select one of the following:

   • Summary Report (CSV file)
   • Detailed Report (Excel file)

Incident export limits

Export up to 1,000 incidents at once. Exports fail when selected incidents exceed 10,000 combined entries. Downloaded files cannot exceed 100 MB.

• Excel and CSV dates use your Server Settings timestamp format. Cortex XSOAR uses the default timestamp format when none is configured.
• CSV field names are standardized as follows:

  • Hyphens (-), underscores (_), and periods (.) become a single space.
  • Field names use title case. For example, COLUMN TITLE becomes Column Title.
  • Special terms, including ID, SLA, ASN, IP, and CVE, remain capitalized.

  Contact Customer Support to export CSV files without field name standardization.