Skip to main content
Skip table of contents

Add Tactics & Techniques To Events‎

POST /Command/SetEventTechniques

Apply tactics/techniques to events

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name

Type

Required/Optional

Description

Username

string

Required

The username of your D3 SOAR account.

Site

string

Required

The D3 SOAR site to run the remote command.

Event IDs

array<integer>

Required

The ID of events to which the tactics and techniques will be added

Tactics

array<string>

Optional

Tactics to set to the specified events

Techniques

array<string>

Optional

Techniques to set to the specified events

Body Sample Data

application/json
JSON
{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Event IDs": [
      6025x,
      6025x
    ],
    "Tactics": [
      "Initial Access",
      "TA0002",
      "TA0003"
    ],
    "Techniques": [
      "Valid Accounts: Cloud Accounts",
      "T1569",
      "Traffic Signaling: Port Knocking"
    ]
  }
}

Response

200 OK

application/json

Response Fields

Field Name

Type

Description

error

string

The error message if the API request has failed.

returnData

string

The return data from the API request.

contextData

array<JSON Object>

The context data from the API request.

Sample Data

JSON
{
    "error": "",
    "returnData": "Successful",
    "contextData": [
        {
            "EventId": 60250,
            "techniques": [
                {
                    "TacticId": "7FF86A9E-205A-E911-80CE-64006A25830x",
                    "TacticName": "Persistence",
                    "TechniqueId": "C395F016-2E88-EB11-B54B-1062E50C63Bx",
                    "TechniqueName": "Traffic Signaling: Port Knocking"
                },
                {
                    "TacticId": "7DF86A9E-205A-E911-80CE-64006A25830x",
                    "TacticName": "Initial Access",
                    "TechniqueId": "F095F016-2E88-EB11-B54B-1062E50C63Bx",
                    "TechniqueName": "Valid Accounts: Cloud Accounts"
                },
                {
                    "TacticId": "7FF86A9E-205A-E911-80CE-64006A25830x",
                    "TacticName": "Persistence",
                    "TechniqueId": "F095F016-2E88-EB11-B54B-1062E50C63Bx",
                    "TechniqueName": "Valid Accounts: Cloud Accounts"
                },
                {
                    "TacticId": "7EF86A9E-205A-E911-80CE-64006A25830x",
                    "TacticName": "Execution",
                    "TechniqueId": "0D96F016-2E88-EB11-B54B-1062E50C63Bx",
                    "TechniqueName": "System Services"
                }
            ]
        },
        {
            "EventId": 60251,
            "techniques": [
                {
                    "TacticId": "7FF86A9E-205A-E911-80CE-64006A25830x",
                    "TacticName": "Persistence",
                    "TechniqueId": "C395F016-2E88-EB11-B54B-1062E50C63Bx",
                    "TechniqueName": "Traffic Signaling: Port Knocking"
                },
                {
                    "TacticId": "7DF86A9E-205A-E911-80CE-64006A25830x",
                    "TacticName": "Initial Access",
                    "TechniqueId": "F095F016-2E88-EB11-B54B-1062E50C63Bx",
                    "TechniqueName": "Valid Accounts: Cloud Accounts"
                },
                {
                    "TacticId": "7FF86A9E-205A-E911-80CE-64006A25830x",
                    "TacticName": "Persistence",
                    "TechniqueId": "F095F016-2E88-EB11-B54B-1062E50C63Bx",
                    "TechniqueName": "Valid Accounts: Cloud Accounts"
                },
                {
                    "TacticId": "7EF86A9E-205A-E911-80CE-64006A25830x",
                    "TacticName": "Execution",
                    "TechniqueId": "0D96F016-2E88-EB11-B54B-1062E50C63Bx",
                    "TechniqueName": "System Services"
                }
            ]
        }
    ]
}

400 BadRequest

application/json

Response Fields

Field Name

Type

Description

Error

string

A error message when the API request fails.

Sample Data

JSON
{"Error": "The body of the request must be a valid JSON object"}

401 Unauthorized

application/json

Response Fields

Field Name

Type

Description

Error

string

A error message when the API request fails.

Sample Data

JSON
{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name

Type

Description

Error

string

A error message when the API request fails.

Sample Data

JSON
{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name

Type

Description

Error

string

A error message when the API request fails.

Sample Data

JSON
{"Error": "Unexpected Error."}
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.