Link Incidents to A New Case
POST /Command/LinkIncidentsToNewCase
Create a new case and link the provided incidents to it. If no incident number provided, link the current incident to the new case.
Request
Authentication: API keys or JSON web tokens (JWT)
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Incident Numbers |
| Optional | The array of incident numbers of incidents which will be linked to a new case. |
Case Owner's Site |
| Optional | The owner's site of the new case. |
Case Reported Date |
| Optional | The reported date of the new case. |
Case Type |
| Optional | The case type of the new case. |
Case Lead Investigators |
| Optional | The lead investigator of the new case. |
Case Priority |
| Optional | The priority level of the new case. |
Case Timezone |
| Optional | The timezone of the new case. |
Copy Form Data |
| Optional | Whether or not to copy incidents' form data to the newly linked case. |
READER NOTE
For Date/Time parameter Case Reported Date
, all times and timestamps must follow the format: yyyy-mm-dd hh:mm:ss.
e.g. May 15, 2024, 2:32 PM should be written as 2024-05-15 14:32:00.