Link Event to Incident
LAST UPDATED: AUG 19, 2024
This command finds the first incident that meets the search condition, then escalates the ingested events to the incident. Additionally, it can update the incident fields by invoking the "Set Incident Fields" command using the input parameter "Incident Fields".
READER NOTE
Please note that this command can only be executed within an event playbook's "On Event Ingestion" trigger.
Implementation | System |
Command Category | System Utility |
Tags | EVENT EVENT LINKING |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Search Conditions | Optional | The search condition is to find the first incident that occurred. The value query corresponding to the key supports regular expressions, string, number, { "$in": ["value1", "value2"] }, and, date:"$date": "2023-08-01T00:00:00Z" format. | { |
Incident Fields | Optional | A JSON array of incidents with fields to be updated. Fields could be Title, SiteName, IncidentType, Status, SeverityName, Disposition, Tags, DueDate, Description, IncidentCategory, DateEnded, Owner, DateOccurred and CustomFields. Date format: yyyy-mm-dd hh:mm:ss | { |