Create An Incident
POST /Command/CreateAnIncident
Creates a new incident with the provided fields.
Request
Authentication: API keys or JSON web tokens (JWT)
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
IncidentType |
| Required | Specifies the type of the incident. Refer to incident form in VSOC to check the valid incident types. |
Title |
| Optional | Specifies the title of the incident |
Description |
| Optional | Specifies the description of the incident |
Severity |
| Optional | Specifies the severity of the incident. The valid options are “Critical“, “High“, “Medium“, “Low“, “Informational“ |
Playbook |
| Optional | Specifies the incident playbook that will executed after incident creation. Refer to incident playbook in VSOC to check the valid playbook names. |
Owner |
| Optional | Specifies the incident owner; the value must be the user’s username. Refer to users in VSOC to check the valid username. The default value is “System“ |
TimeZone |
| Optional | Specifies the Time Zone of the incident. The default value is “(UTC+00:00) Coordinated Universal Time“ |
DueDate |
| Optional | Specifies the due datetime of the incident. Note: the due date cannot before current datetime. |
RawData |
| Optional | Specifies the addition fields in rawdata that needs to be included in the incident. |
READER NOTE
For Date/Time parameters Start Time
and End Time
, all times and timestamps must follow the format: yyyy-mm-dd hh:mm:ss
.
e.g. May 15, 2024, 2:32 PM should be written as 2024-05-15 14:32:00.
READER NOTE
The “TimeZone” input parameter format is (GMT±hh:mm) Time Zone Name
, where GMT
stands for Greenwich Mean Time, ±
indicates the offset direction (ahead +
or behind -
GMT), and hh:mm
represents the hours and minutes of the offset. For example, (GMT-12:00) International Date Line West
.