Get Incident Static Field‎

POST /Command/getIncidentStaticField

Get Incident Static Field Values.

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Incident Number	`string`	Required	Incident Number to retrieve the static field values from.
Site Name	`string`	Optional	The site containing the incident, if left empty will use the runtime site.
Username	`string`	Optional	The username of user who accesses the incident. This username will only be used when the task auto-runs. If left empty, will default to the system user.

Body Sample Data

application/json

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Number": "TEST-INCIDENT-73",
    "Site Name": "Security Operations",
    "Username": "admin user"
  }
}

Response

200 OK

application/json

Field Name	Type	Description
error	`string`	The error message if the API request has failed.
returnData	`JSON Object`	The return data from the API request.

{
    "error": "",
    "returnData": {
      "Status": "Successful",
      "Data": {
          "CaseNumber": "TEST-INCIDENT-75",
          "CreatorFullName": "D3 admin",
          "Title": "Test title",
          "Site": "Security Operations",
          "TimeZone": "PST",
          "Severity": "Low",
          "Owner": "D3 admin",
          "AssigneeName": "D3 admin",
          "Status": "Open",
          "IRTypeName": "Active Shooter",
          "Disposition": "False Positive",
          "ChangedDate": "2022-01-24 16:57:32",
          "DateCreated": "2022-01-24 16:57:32",
          "DateModified": "2022-01-27 10:52:59",
          "ClosedBy": "D3 admin",
          "DateClosed": "2022-01-28 12:19:33",
          "PlayBook Name": [
              {
                  "PlaybookName": "Test Playbook"
              }
          ],
          "Descriptions": "Test Descriptions",
          "Conclusion": "",
          "Note": [],
          "Linked Incident": [],
          "Investigation Team": [],
          "Tag": []
      }
    }
}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "Unexpected Error."}