Get Incident Timeline Entries
POST /Command/GetIncidentTimelineEntries
This command retrieves the timeline entries of an incident and additionally gathers associated metadata, providing a comprehensive overview of the incident's chronological events and relevant details.
Request
Authentication: API keys or JSON web tokens (JWT)
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Incident Number |
| Required | The incident number for which the timeline entries will be retrieved. |
Filter |
| Optional | The filter selectively displays entries by searching specific fields, such as Author, event times, summary, notes, description, risk name, and event type, for terms matching the defined criteria. |
Sort Order |
| Optional | The sort order specifies how data is arranged in a timeline, either in ascending order from earliest to latest, or in descending order from latest to earliest. |