Create Incident

LAST UPDATED: SEPT 19, 2024

Escalates a newly ingested event to an incident, initializing both static and custom fields.

READER NOTE

This command takes effect in the Event Playbook when a new event is ingested into the system.
The output for this command does not currently indicate whether an incident was successfully found or linked. The Return Data solely confirms the validity of the input parameters.
- To verify whether a relevant incident has been linked, and to determine whether a new or existing incident was used in the linking process, locate the event in the "All Escalated" section under the "Events" accordion within the investigative dashboard, and check the creation time of the incident.

Implementation	System
Command Category	System Utility
Tags	INCIDENT INCIDENT ESCALATION EVENT PLAYBOOK

Inputs

Parameter Name	Required/Optional	Description	Sample Data
Incident Type	Required	The incident type.	Playbook - Phishing
Title	Optional	The incident title.	Critical phishing incident
Description	Optional	The incident description.	This is a phishing incident that requires investigation.
Severity	Optional	The incident severity.	Low
Playbook	Required	The incident playbook.	123
Owner	Optional	The incident owner.	admin
External Key	Optional	An external key is a unique key: outside of D3. Keep the field empty if you do not have one.	20220111-1
Custom Fields	Optional	User defined custom fields. The field name must have the prefix "Custom" and use PascalCase format. If the name does not follow this rule, it will be converted.	CODE `{ "CustomField1": "data1", "CustomField2": "data2", "CustomField3": "data3" }`
Event Id	Optional	The ID corresponding to an event used for incident escalation. If this ID is not provided, the runtime event will be used instead. A new incident will not be created if the specified event has already been escalated to an incident of the same type.	11160030

Output

Return Data

The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.

SAMPLE DATA

JSON

{
    "Status": "Successful"
}