Skip to main content
Skip table of contents

Link Incidents to A New Case‎

POST /Command/LinkIncidentsToNewCase

Create a new case and link the provided incidents to it. If no incident number provided, link the current incident to the new case.

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name

Type

Required/Optional

Description

Username

string

Required

The username of your D3 SOAR account.

Site

string

Required

The D3 SOAR site to run the remote command.

Incident Numbers

array<string>

Optional

The array of incident numbers of incidents which will be linked to a new case.

Case Owner's Site

string

Optional

The owner's site of the new case.

Case Reported Date

string

Optional

The reported date of the new case.

Case Type

string

Optional

The case type of the new case.

Case Lead Investigators

string

Optional

The lead investigator of the new case.

Case Priority

string

Optional

The priority level of the new case.

Case Timezone

string

Optional

The timezone of the new case.

Copy Form Data

string

Optional

Whether or not to copy incidents' form data to the newly linked case.

READER NOTE

For Date/Time parameter Case Reported Date, all times and timestamps must follow the format: yyyy-mm-dd hh:mm:ss.

  • e.g. May 15, 2024, 2:32 PM should be written as 2024-05-15 14:32:00.

Body Sample Data

application/json
CODE
{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Numbers": [
      "20210330-180",
      "20210330-181"
    ],
    "Case Owner's Site": "Security Operations",
    "Case Reported Date": "2021-01-26 00:00:00",
    "Case Type": "Criminal Investigation",
    "Case Lead Investigators": "admin user",
    "Case Priority": "3",
    "Case Timezone": "(GMT-08:00) Pacific Standard Time",
    "Copy Form Data": "Yes",
    "Username": "admin user"
  }
}

Response

200 OK

application/json

Field Name

Type

Description

error

string

The error message if the API request has failed.

returnData

string

The return data from the API request.

contextData

array<JSON Object>

The context data from the API request.

CODE
{
    "error": "",
    "returnData": "20210330-16",
    "contextData": [
      {
          "IncidentNumber": "20210330-180",
          "LinkedCaseNumber": "20210330-16",
          "UpdatedForm": [
              {
                  "ID": 223,
                  "Name": "ABC 01"
              },
              {
                  "ID": 1112,
                  "Name": "MySection"
              }
          ]
      },
      {
          "IncidentNumber": "20210330-181",
          "LinkedCaseNumber": "20210330-16",
          "UpdatedForm": [
              {
                  "ID": 223,
                  "Name": "ABC 01"
              },
              {
                  "ID": 1112,
                  "Name": "MySection"
              }
          ]
      }
  ]
}

401 Unauthorized

application/json

Response Fields

Field Name

Type

Description

Error

string

A error message when the API request fails.

Sample Data

CODE
{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name

Type

Description

Error

string

A error message when the API request fails.

Sample Data

CODE
{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name

Type

Description

Error

string

A error message when the API request fails.

Sample Data

CODE
{"Error": "Unexpected Error."}
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.