Get Related Incidents by Artifact‎

POST /Command/GetRelatedIncidentsByArtifact

Get Related Incident's Information.

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Artifact Type	`string`	Required	Artifact type to be filtered by.
Artifact Name(s)	`array<string>`	Required	An array of artifact name(s) to be filtered by. The artifact in the array should match the artifact type specified in the above input.
Search Within Last Number of Days	`integer`	Required	The day range relative to the incident's created date (UTC). For example, incidents created in the last 90 days.
Maximum Number of Results	`integer`	Required	The maximum number of incidents to be returned.

Body Sample Data

application/json

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Artifact Type": "Internal Endpoint",
    "Artifact Name(s)": [
      "192.168.1.123",
      "D3CYBER-DC"
    ],
    "Search Within Last Number of Days": 90,
    "Maximum Number of Results": 10
  }
}

Response

200 OK

application/json

Field Name	Type	Description
error	`string`	The error message if the API request has failed.
returnData	`array<JSON Object>`	The return data from the API request.

{
    "error": "",
    "returnData": [
      {
          "Status": "Successful",
          "Data": [
              {
                  "Creator": "admin user",
                  "CreatorID": 1,
                  "Description": "Description",
                  "ID": 1,
                  "IncidentNo": "20221203-1",
                  "IncidentTypeID": 1,
                  "IncidentTypeName": "Playbook - Phishing",
                  "Owner": "admin user",
                  "OwnerID": 1,
                  "OwnerSite": "Site",
                  "OwnerSiteID": 95,
                  "ReportingDate": "2022-12-03T02:20:05Z",
                  "ReportingUtcDate": "2022-12-02T18:20:05Z",
                  "SeverityID": 5,
                  "SeverityName": "Critical",
                  "Status": "Closed",
                  "StatusID": 3,
                  "TimeZone": "China Standard Time",
                  "Title": "Title"
              }
          ]
      }
    ]
}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "Unexpected Error."}