Run Playbooks‎ | docs.d3security

POST /Command/RunPlaybooks

Add playbook(s) to incident and run these playbooks with the given incidents.

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Playbook Names	`array<string>`	Required	The playbook names.
Incident Numbers	`array<string>`	Required	The Incident number to run playbook.

Body Sample Data

application/json

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Playbook Names": [
      "runPlaybookComand1"
    ],
    "Incident Numbers": [
      "20220725-12"
    ]
  }
}

Response

200 OK

application/json

Field Name	Type	Description
error	`string`	The error message if the API request has failed.
returnData	`string`	The return data from the API request.
contextData	`array<JSON Object>`	The context data from the API request.

{
    "error": "",
    "returnData": "Successful",
    "contextData": [
      {
          "Incident Number": "20220725-12",
          "Playbook List": [
              "runPlaybookComand1"
          ],
          "Result": "Successful"
      }
    ]
}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "Unexpected Error."}