Skip to main content
Skip table of contents

Create Incident

LAST UPDATED: SEPT 19, 2024

Escalates a newly ingested event to an incident, initializing both static and custom fields.

READER NOTE

  • This command takes effect in the Event Playbook when a new event is ingested into the system.

  • The output for this command does not currently indicate whether an incident was successfully found or linked. The Return Data solely confirms the validity of the input parameters.

    • To verify whether a relevant incident has been linked, and to determine whether a new or existing incident was used in the linking process, locate the event in the "All Escalated" section under the "Events" accordion within the investigative dashboard, and check the creation time of the incident.

Implementation

System

Command Category

System Utility

Tags

INCIDENT INCIDENT ESCALATION EVENT PLAYBOOK

Inputs

Parameter Name

Required/Optional

Description

Sample Data

Incident Type

Required

The incident type.

Playbook - Phishing

Title

Optional

The incident title.

Critical phishing incident

Description

Optional

The incident description.

This is a phishing incident that requires investigation.

Severity

Optional

The incident severity.

Low

Playbook

Required

The incident playbook.

123

Owner

Optional

The incident owner.

admin

External Key

Optional

An external key is a unique key: outside of D3. Keep the field empty if you do not have one.

20220111-1

Custom Fields

Optional

User defined custom fields. The field name must have the prefix "Custom" and use PascalCase format. If the name does not follow this rule, it will be converted.

CODE
{
  "CustomField1": "data1",
  "CustomField2": "data2",
  "CustomField3": "data3"
}

Event Id

Optional

The ID corresponding to an event used for incident escalation. If this ID is not provided, the runtime event will be used instead. A new incident will not be created if the specified event has already been escalated to an incident of the same type.

11160030

Output

Return Data

The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.

SAMPLE DATA

JSON
{
    "Status": "Successful"
}
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.