> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/export-incidents-to-csv.md).

# Export Incidents to CSV

You can create a script to export incidents to a CSV file.

This example automation exports the last week's active incidents and downloads it as a file to the War Room or Playground.

Use the basic automation template to create the following code.

* The first step is to create the body of the request that is sent to the Cortex XSOAR REST API.  This request body queries for incidents with **`status:active`**, sorts descending on the **`id`** field, returns only incidents from the last seven days, and the set of columns to return in the CSV file.
* The **`demisto.executeCommand()`** function posts the request to the Cortex XSOAR server and returns the name of the CSV file created as **`fileName`**.
* The **`demisto.executeCommand()`** function downloads the CSV from the Cortex XSOAR server and saves it as part of the investigation.
* The **`return_results()`** function and **`fileResult()`** function add the file to the War Room or Playground where a download link is presented and a user can download the file.

```programlisting
def main():
    try:
        reqBody = {
            'all': True,
            'filter': {
                'query': "status:active",
                'sort': [{
                'field': "id",
                'asc': False
                }],
                'period': {
                'by': "day",
                'fromValue': 7
                }
            },
            'columns': [
                "id",
                "name",
                "type",
                "severity",
                "status",
                "owner",
                "roles",
                "playbookId",
                "occurred",
                "created",
                "modified",
                "closed"
            ]
        }

        fileName = demisto.executeCommand("core-api-post", {
            'uri': "/incident/batch/exportToCsv", 
            'body': reqBody
        })[0]['Contents']['response']

        file = demisto.executeCommand("core-api-get", {
            'uri': "/incident/csv/" + fileName
        })[0]['Contents']['response']

        return_results(fileResult(fileName, file))
    except Exception as ex:
        demisto.error(traceback.format_exc())
        return_error("Failed to execute REST API: " + str(ex))

if __name__ in ("__main__", "__builtin__", "builtins"):
    main()
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/export-incidents-to-csv.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.