Set Incident Fields‎ | docs.d3security

POST /Command/SetIncidentFields

Updates fields for an incident with specified values in a JSON object.

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Incident Number	`string`	Required	The incident number to set the fields to.
Input	`JSON Object`	Required	A JSON object of an incident with fields to be updated. Fields could be Title, SiteName, IncidentType, Status, SeverityName, Disposition, Tags, DueDate, Description, IncidentCategory, DateEnd, Owner, DateOccurred and CustomFields. Date format: yyyy-mm-dd hh:mm:ss.

READER NOTE

For Date/Time parameter Input, all times and timestamps must follow the format: yyyy-mm-dd hh:mm:ss .

e.g. May 15, 2024, 2:32 PM should be written as 2024-05-15 14:32:00.

Body Sample Data

application/json

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Number": "20110803-1",
    "Input": {
      "Title": "Incident title",
      "SiteName": "APSOC",
      "IncidentType": "Phishing",
      "Status": "Closed",
      "SeverityName": "medium",
      "Disposition": "No Action",
      "Tags": "MyTag, MyTag2",
      "Description": "This is for updating incident",
      "DueDate": "2021-08-01 12:00:00",
      "IncidentCategory": "Access",
      "DateEnded": "2021-08-02 12:00:00",
      "Owner": "firstname lastname",
      "DateOccurred": "2021-08-02 12:00:00",
      "CustomAge": "30",
      "CustomSpecialField": "some special text"
    }
  }
}

Response

200 OK

application/json

Field Name	Type	Description
error	`string`	The error message if the API request has failed.
returnData	`string`	The return data from the API request.
contextData	`JSON Object`	The context data from the API request.

JSON

{
    "error": "",
    "returnData": "Successful",
    "contextData": {
        "Title": "Incident title",
        "SiteName": "APSOC",
        "IncidentType": "Phishing",
        "Status": "Closed",
        "SeverityName": "medium",
        "Disposition": "No Action",
        "Tags": "MyTag, MyTag2",
        "Description": "This is for updating incident",
        "DueDate": "2021-08-01 12:00:00",
        "IncidentCategory": "Access",
        "DateEnded": "2021-08-02 12:00:00",
        "Owner": "firstname lastname",
        "DateOccurred": "2021-08-02 12:00:00",
        "CustomAge": "30",
        "CustomSpecialField": "some special text"
    }
}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

{"Error": "Unexpected Error."}