Close Incidents in Bulk ‎

POST /Command/CloseIncidentInBulk

Close multiple incidents that are given by input incident numbers.

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`array<string>`	Required	The D3 SOAR site to run the remote command.
Incident Numbers	`array<string>`	Required	The array of incident numbers of incidents that are to be closed.
Bypass Required Pending Tasks	`boolean`	Required	The option of whether or not to close incidents even there still are required pending tasks.
Bypass All Required Fields	`boolean`	Optional	The option of whether or not to close incidents even required fields are not filled.
Username	`string`	Optional	The username of user that close the incidents. This username will be used only when the task is run automatically.
Conclusion	`string`	Optional	Append the conclusion note to the original conclusion.

Body Sample Data

application/json

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Numbers": [
      "20210127-198",
      "20210127-197"
    ],
    "Bypass Required Pending Tasks": "Yes",
    "Bypass All Required Fields": "Yes",
    "Username": "admin user",
    "Conclusion": "The incident was closed in bulk."
  }
}

Response

200 OK

application/json

Response Fields

Field Name	Type	Description
error	`string`	The error message if the command execution failed.
returnData	`string`	The return data from the API request.
contextData	`array<string>`	The context data from the API request.

Sample Data

{
    "error": "",
    "returnData": "Successful",
    "contextData": [
    {
        "Incident Number": "20210127-198",
        "Status": "Closed",
        "Close Date": "01/27/2021 06:08 AM PST",
        "Result": "Successful",
        "Closed By": "admin user"
    },
    {
        "Incident Number": "20210127-197",
        "Status": "Closed",
        "Close Date": "01/27/2021 06:08 AM PST",
        "Result": "Successful",
        "Closed By": "admin user"
    }
  ]
}

400 BadRequest

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The body of the request must be a valid JSON object"}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Unexpected Error."}