Skip to main content


This Script is part of the Cherwell Pack.#

This script is an example script of how to query incidents from Cherwell. The script wraps the cherwell-query-business-object command of the cherwell integration. When writing your own script to query business objects, follow the instructions found in the configuration section of the script, but do not change the execution section.

Script Data#

Script Typepython3
Cortex XSOAR Version5.0.0


This script uses the following commands and scripts.

  • cherwell-query-business-object


Argument NameDescription
queryThe query to run. The query is a list of comma-seperated filters such that each filter should be of the form: ["field_name","operator","value"] and operator is one of: 'eq'=equal, 'gt'=greater-than, 'lt'=less-than, 'contains', 'startwith'. Special characters shoud be escaped.
Example: `[["CreatedDateTime":"gt":"4/10/2019 3:10:12 PM"]["Priority","eq","1"]]`.
NOTICE: If multiple filters are received for the same field name, an 'OR' operation between the filters is performed. If the field names are different, an 'AND' operation is performed.


Cherwell.QueryResults.RecordIdRecoed IDString
Cherwell.QueryResults.PublicIdPublic IDString
Cherwell.QueryResults.DescriptionIncident descriptionString
Cherwell.QueryResults.PriorityIncident ptiorityNumber
Cherwell.QueryResults.OwnedByIncident owned by fieldString
Cherwell.QueryResults.ServiceService needed for the incidentString
Cherwell.QueryResults.CustomerDisplayNameIncident reporting customerString
Cherwell.BusinessObject.CreatedDateTimeCreated date timeString
Cherwell.BusinessObject.TotalTasksTotal tasks for this incidentNumber