Link Incidents to A New Case

Create a new case and link the provided incidents to it. If no incident number provided, link the current incident to the new case.

Implementation	System
Command Category	System Utility
Tags	INCIDENT INCIDENT LINKING

Inputs

Parameter Name	Required/Optional	Description	Sample Data
Incident Numbers	Optional	The array of incident numbers of incidents which will be linked to a new case.	CODE `[ "20210330-180", "20210330-181" ]`
Case Owner's Site	Optional	The owner's site of the new case.	`Security Operations`
Case Reported Date	Optional	The reported date of the new case.	`2021-01-26 00:00:00`
Case Type	Optional	The case type of the new case.	`Criminal Investigation`
Case Lead Investigators	Optional	The lead investigator of the new case.	`admin user`
Case Priority	Optional	The priority level of the new case.	`"3"`
Case Timezone	Optional	The timezone of the new case.	`(GMT-08:00) Pacific Standard Time`
Copy Form Data	Optional	Whether or not to copy incidents' form data to the newly linked case.	`Yes`
Username	Optional	The username of user that link incidents to a new case. This username will be used only when the task is run automatically.	`admin user`

Output

Return Data

The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.

SAMPLE DATA

JSON

20210330-16

Context Data

The response data from the utility command.

SAMPLE DATA

JSON

[
    {
        "IncidentNumber": "20210330-180",
        "LinkedCaseNumber": "20210330-16",
        "UpdatedForm": [
            {
                "ID": 223,
                "Name": "ABC 01"
            },
            {
                "ID": 1112,
                "Name": "MySection"
            }
        ]
    },
    {
        "IncidentNumber": "20210330-181",
        "LinkedCaseNumber": "20210330-16",
        "UpdatedForm": [
            {
                "ID": 223,
                "Name": "ABC 01"
            },
            {
                "ID": 1112,
                "Name": "MySection"
            }
        ]
    }
]

Remote Command API

The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.

Request

POST

CODE

https:/{base_url}/{api_namespace}/api/Command/LinkIncidentsToNewCase

Headers

Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.

Request Body

JSON

{
  "Username": "<Username here>",
  "Site": "<Site here>",
  "CommandParams": {
    "Incident Numbers": "<Incident Numbers here>",
    "Case Owner's Site": "<Case Owner's Site here>",
    "Case Reported Date": "<Case Reported Date here>",
    "Case Type": "<Case Type here>",
    "Case Lead Investigators": "<Case Lead Investigators here>",
    "Case Priority": "<Case Priority here>",
    "Case Timezone": "<Case Timezone here>",
    "Copy Form Data": "<whether to Copy Form Data>",
    "Username": "<Username here>"
  }
}

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`Text`	Required	The username of your D3 SOAR account.
Site	`Text`	Required	The D3 SOAR site to run the remote command.
Incident Numbers	`Text Array`	Optional	The array of incident numbers of incidents which will be linked to a new case.
Case Owner's Site	`String`	Optional	The owner's site of the new case.
Case Reported Date	`DateTime`	Optional	The reported date of the new case.
Case Type	`Text`	Optional	The case type of the new case.
Case Lead Investigators	`Text`	Optional	The lead investigator of the new case.
Case Priority	`Text`	Optional	The priority level of the new case.
Case Timezone	`Boolean`	Optional	The timezone of the new case.
Copy Form Data	`Text`	Optional	Whether or not to copy incidents' form data to the newly linked case.

Sample Request

SAMPLE DATA

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Numbers": [
      "20210330-180",
      "20210330-181"
    ],
    "Case Owner's Site": "Security Operations",
    "Case Reported Date": "2021-01-26 00:00:00",
    "Case Type": "Criminal Investigation",
    "Case Lead Investigators": "admin user",
    "Case Priority": "3",
    "Case Timezone": "(GMT-08:00) Pacific Standard Time",
    "Copy Form Data": "Yes",
    "Username": "admin user"
  }
}

Response

Response Fields

Field Name	Type	Description
error	`Text`	The error message if the API request has failed.
returnData	`Text`	The return data from the API request.
contextData	`JSON Array`	The context data from the API request.

Sample Response

JSON

{
    "error": "",
    "returnData": "20210330-16",
    "contextData": [
      {
          "IncidentNumber": "20210330-180",
          "LinkedCaseNumber": "20210330-16",
          "UpdatedForm": [
              {
                  "ID": 223,
                  "Name": "ABC 01"
              },
              {
                  "ID": 1112,
                  "Name": "MySection"
              }
          ]
      },
      {
          "IncidentNumber": "20210330-181",
          "LinkedCaseNumber": "20210330-16",
          "UpdatedForm": [
              {
                  "ID": 223,
                  "Name": "ABC 01"
              },
              {
                  "ID": 1112,
                  "Name": "MySection"
              }
          ]
      }
  ]
}