Link Incidents to A New Case
LAST UPDATED: SEPT 04, 2024
Creates a new case and adds the provided incidents to it. The command defaults to adding the current runtime incident to the new case if no specific incident number is provided.
Implementation | System |
Command Category | System Utility |
Tags | INCIDENT INCIDENT LINKING |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Incident Numbers | Required | The array of incident numbers of incidents which will be linked to a new case. |
CODE
|
Case Owner's Site | Required | The owner's site of the new case. | Security Operations |
Case Reported Date | Required | The reported date of the new case. | 2021-01-26 00:00:00 |
Case Type | Required | The case type of the new case. | Criminal Investigation |
Case Lead Investigators | Required | The lead investigator of the new case. | admin user |
Case Priority | Required | The priority level of the new case. | "3" |
Case Timezone | Required | The time zone of the new case. | (GMT-08:00) Pacific Standard Time |
Copy Form Data | Optional | Whether or not to copy incidents' form data to the newly linked case. | Yes |
Username | Required | The username of user who links incidents to a new case. This username will be used only when the task is run automatically. | admin user |
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/LinkIncidentsToNewCase
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": "<Username here>",
"Site": "<Site here>",
"CommandParams": {
"Incident Numbers": "<Incident Numbers here>",
"Case Owner's Site": "<Case Owner's Site here>",
"Case Reported Date": "<Case Reported Date here>",
"Case Type": "<Case Type here>",
"Case Lead Investigators": "<Case Lead Investigators here>",
"Case Priority": "<Case Priority here>",
"Case Timezone": "<Case Timezone here>",
"Copy Form Data": "<whether to Copy Form Data>",
"Username": "<Username here>"
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Incident Numbers |
| Required | The array of incident numbers of incidents which will be linked to a new case. |
Case Owner's Site |
| Required | The owner's site of the new case. |
Case Reported Date |
| Required | The reported date of the new case. |
Case Type |
| Required | The case type of the new case. |
Case Lead Investigators |
| Required | The lead investigator of the new case. |
Case Priority |
| Required | The priority level of the new case. |
Case Timezone |
| Required | The time zone of the new case. |
Copy Form Data |
| Optional | Whether or not to copy incidents' form data to the newly linked case. |
Username |
| Required | The username of user who links incidents to a new case. This username will be used only when the task is run automatically. |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Incident Numbers": [
"20210330-180",
"20210330-181"
],
"Case Owner's Site": "Security Operations",
"Case Reported Date": "2021-01-26 00:00:00",
"Case Type": "Criminal Investigation",
"Case Lead Investigators": "admin user",
"Case Priority": "3",
"Case Timezone": "(GMT-08:00) Pacific Standard Time",
"Copy Form Data": "Yes",
"Username": "admin user"
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
returnData |
| The return data from the API request. |
contextData |
| The context data from the API request. |
Sample Response
{
"error": "",
"returnData": "20210330-16",
"contextData": [
{
"IncidentNumber": "20210330-180",
"LinkedCaseNumber": "20210330-16",
"UpdatedForm": [
{
"ID": 223,
"Name": "ABC 01"
},
{
"ID": 1112,
"Name": "MySection"
}
]
},
{
"IncidentNumber": "20210330-181",
"LinkedCaseNumber": "20210330-16",
"UpdatedForm": [
{
"ID": 223,
"Name": "ABC 01"
},
{
"ID": 1112,
"Name": "MySection"
}
]
}
]
}