Add Investigation Table Content ‎

POST /Command/AddInvestigationTableContent

Add a table to an incident investigation section.

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Incident Number	`string`	Required	The incident number to add investigation details to.
Investigation Section	`string`	Required	The section to add the investigation detail to. If you select IOA or IOC, data tables will be created and displayed under findings, but they will not populate in link analysis. Use the Add Investigation Details command to populate IOA and IOC in link analysis.
Investigation Detail in JSON	`JSON Object`	Required	JSON data for creating the table to be added to the investigation detail.
Editing Type	`string`	Required	Choose whether to add a new investigation detail or overwrite all existing details.

Body Sample Data

application/json

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Number": "20220829-13",
    "Investigation Section": "Summary",
    "Investigation Detail in JSON": {
      "Title": "Sample Datatable",
      "Description": "An example to add a table to investigation tab of an incident.",
      "Fields": [
        {
          "Title": "Name",
          "Name": "name"
        },
        {
          "Title": "Age",
          "Name": "age"
        },
        {
          "Title": "Address",
          "Name": "address"
        },
        {
          "Title": "Date",
          "Name": "date"
        }
      ],
      "Data": [
        {
          "name": "John Brown",
          "age": 18,
          "address": "New York No. 1 Lake Park",
          "date": "2016-10-03"
        },
        {
          "name": "Jim Green",
          "age": 24,
          "address": "London No. 1 Lake Park",
          "date": "2016-10-01"
        },
        {
          "name": "Joe Black",
          "age": 30,
          "address": "Sydney No. 1 Lake Park",
          "date": "2016-10-02"
        },
        {
          "name": "Jon Snow",
          "age": 26,
          "address": "Ottawa No. 2 Lake Park",
          "date": "2016-10-04"
        }
      ],
      "Highlight": [
        {
          "Text": [
            "John"
          ],
          "IsBold": true,
          "Color": "#42c765"
        }
      ]
    },
    "Editing Type": "Overwrite"
  }
}

Response

200 OK

application/json

Response Fields

Field Name	Type	Description
error	`string`	The error message if the command execution failed.
returnData	`JSON Object`	The return data from the API request.
contextData	`JSON Object`	The context data from the API request.

Sample Data

CODE

{
    "error": "",
    "returnData": "Successful",
    "contextData": {
        "ID": 36,
        "IncidentId": 166,
        "TypeId": 201,
        "Creator": 1,
        "LastModifiedBy": 1,
        "CreatedUtcTime": "2023-04-14T18:27:25.167",
        "CreatedTime": "2023-04-14T19:27:00",
        "LastModifiedUtcTime": "2023-04-17T19:12:42.450",
        "LastModifiedTime": "2023-04-17T20:12:00",
        "InvestigationDetail": [
            {
                "ID": 141,
                "InvestigationId": 36,
                "AddedBy": 1,
                "LastModifiedBy": 1,
                "RuntimeTaskId": -1,
                "Data": "{\r\n  \"Titile\": \"Sample Datatable\",\r\n  \"Description\": \"An example to add a table to investigation tab of an incident.\",\r\n  \"Fields\": [\r\n    {\r\n      \"Title\": \"Name\",\r\n      \"Name\": \"name\"\r\n    },\r\n    {\r\n      \"Title\": \"Age\",\r\n      \"Name\": \"age\"\r\n    },\r\n    {\r\n      \"Title\": \"Address\",\r\n      \"Name\": \"address\"\r\n    },\r\n    {\r\n      \"Title\": \"Date\",\r\n      \"Name\": \"date\"\r\n    }\r\n  ],\r\n  \"Data\": [\r\n    {\r\n      \"name\": \"John Brown\",\r\n      \"age\": 18,\r\n      \"address\": \"New York No. 1 Lake Park\",\r\n      \"date\": \"2016-10-03\"\r\n    },\r\n    {\r\n      \"name\": \"Jim Green\",\r\n      \"age\": 24,\r\n      \"address\": \"London No. 1 Lake Park\",\r\n      \"date\": \"2016-10-01\"\r\n    },\r\n    {\r\n      \"name\": \"Joe Black\",\r\n      \"age\": 30,\r\n      \"address\": \"Sydney No. 1 Lake Park\",\r\n      \"date\": \"2016-10-02\"\r\n    },\r\n    {\r\n      \"name\": \"Jon Snow\",\r\n      \"age\": 26,\r\n      \"address\": \"Ottawa No. 2 Lake Park\",\r\n      \"date\": \"2016-10-04\"\r\n    }\r\n  ]\r\n}",
                "Type": 1,
                "CreatedUtcTime": "2023-04-17T19:12:42.450",
                "CreatedTime": "2023-04-17T20:12:00",
                "LastModifiedUtcTime": "2023-04-17T19:12:42.450",
                "LastModifiedTime": "2023-04-17T20:12:00",
                "IsDeleted": false
            }
        ]
    }
}

400 BadRequest

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The body of the request must be a valid JSON object"}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Unexpected Error."}