Link Incidents to A New Case‎

POST /Command/LinkIncidentsToNewCase

Create a new case and link the provided incidents to it. If no incident number provided, link the current incident to the new case.

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Incident Numbers	`array<string>`	Optional	The array of incident numbers of incidents which will be linked to a new case.
Case Owner's Site	`string`	Optional	The owner's site of the new case.
Case Reported Date	`string`	Optional	The reported date of the new case.
Case Type	`string`	Optional	The case type of the new case.
Case Lead Investigators	`string`	Optional	The lead investigator of the new case.
Case Priority	`string`	Optional	The priority level of the new case.
Case Timezone	`string`	Optional	The timezone of the new case.
Copy Form Data	`string`	Optional	Whether or not to copy incidents' form data to the newly linked case.

READER NOTE

For Date/Time parameter Case Reported Date, all times and timestamps must follow the format: yyyy-mm-dd hh:mm:ss.

e.g. May 15, 2024, 2:32 PM should be written as 2024-05-15 14:32:00.

Body Sample Data

application/json

CODE

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Numbers": [
      "20210330-180",
      "20210330-181"
    ],
    "Case Owner's Site": "Security Operations",
    "Case Reported Date": "2021-01-26 00:00:00",
    "Case Type": "Criminal Investigation",
    "Case Lead Investigators": "admin user",
    "Case Priority": "3",
    "Case Timezone": "(GMT-08:00) Pacific Standard Time",
    "Copy Form Data": "Yes",
    "Username": "admin user"
  }
}

Response

200 OK

application/json

Field Name	Type	Description
error	`string`	The error message if the API request has failed.
returnData	`string`	The return data from the API request.
contextData	`array<JSON Object>`	The context data from the API request.

CODE

{
    "error": "",
    "returnData": "20210330-16",
    "contextData": [
      {
          "IncidentNumber": "20210330-180",
          "LinkedCaseNumber": "20210330-16",
          "UpdatedForm": [
              {
                  "ID": 223,
                  "Name": "ABC 01"
              },
              {
                  "ID": 1112,
                  "Name": "MySection"
              }
          ]
      },
      {
          "IncidentNumber": "20210330-181",
          "LinkedCaseNumber": "20210330-16",
          "UpdatedForm": [
              {
                  "ID": 223,
                  "Name": "ABC 01"
              },
              {
                  "ID": 1112,
                  "Name": "MySection"
              }
          ]
      }
  ]
}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

CODE

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

CODE

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

CODE

{"Error": "Unexpected Error."}