Skip to main content
Skip table of contents

Link Incidents to A New Case

LAST UPDATED: SEPT 04, 2024

Creates a new case and adds the provided incidents to it. The command defaults to adding the current runtime incident to the new case if no specific incident number is provided.

Implementation

System

Command Category

System Utility

Tags

INCIDENT INCIDENT LINKING

Inputs

Parameter Name

Required/Optional

Description

Sample Data

Incident Numbers

Required

The array of incident numbers of incidents which will be linked to a new case.

CODE
[
    "20210330-180",
    "20210330-181"
]

Case Owner's Site

Required

The owner's site of the new case.

Security Operations

Case Reported Date

Required

The reported date of the new case.

2021-01-26 00:00:00

Case Type

Required

The case type of the new case.

Criminal Investigation

Case Lead Investigators

Required

The lead investigator of the new case.

admin user

Case Priority

Required

The priority level of the new case.

"3"

Case Timezone

Required

The time zone of the new case.

(GMT-08:00) Pacific Standard Time

Copy Form Data

Optional

Whether or not to copy incidents' form data to the newly linked case.

Yes

Username

Required

The username of user who links incidents to a new case. This username will be used only when the task is run automatically.

admin user

Output

Return Data

The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.

SAMPLE DATA

JSON
20210330-16
Context Data

The response data from the utility command.

SAMPLE DATA

JSON
[
    {
        "IncidentNumber": "20210330-180",
        "LinkedCaseNumber": "20210330-16",
        "UpdatedForm": [
            {
                "ID": 223,
                "Name": "ABC 01"
            },
            {
                "ID": 1112,
                "Name": "MySection"
            }
        ]
    },
    {
        "IncidentNumber": "20210330-181",
        "LinkedCaseNumber": "20210330-16",
        "UpdatedForm": [
            {
                "ID": 223,
                "Name": "ABC 01"
            },
            {
                "ID": 1112,
                "Name": "MySection"
            }
        ]
    }
]

Remote Command API

The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.

Request

POST

CODE
https:/{base_url}/{api_namespace}/api/Command/LinkIncidentsToNewCase

Headers

Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.

Request Body

JSON
{
  "Username": "<Username here>",
  "Site": "<Site here>",
  "CommandParams": {
    "Incident Numbers": "<Incident Numbers here>",
    "Case Owner's Site": "<Case Owner's Site here>",
    "Case Reported Date": "<Case Reported Date here>",
    "Case Type": "<Case Type here>",
    "Case Lead Investigators": "<Case Lead Investigators here>",
    "Case Priority": "<Case Priority here>",
    "Case Timezone": "<Case Timezone here>",
    "Copy Form Data": "<whether to Copy Form Data>",
    "Username": "<Username here>"
  }
}

Body Parameters

Parameter Name

Type

Required/Optional

Description

Username

string

Required

The username of your D3 SOAR account.

Site

string

Required

The D3 SOAR site to run the remote command.

Incident Numbers

array<string>

Required

The array of incident numbers of incidents which will be linked to a new case.

Case Owner's Site

string

Required

The owner's site of the new case.

Case Reported Date

string

Required

The reported date of the new case.

Case Type

string

Required

The case type of the new case.

Case Lead Investigators

string

Required

The lead investigator of the new case.

Case Priority

string

Required

The priority level of the new case.

Case Timezone

string

Required

The time zone of the new case.

Copy Form Data

string

Optional

Whether or not to copy incidents' form data to the newly linked case.

Username

string

Required

The username of user who links incidents to a new case. This username will be used only when the task is run automatically.

Sample Request

SAMPLE DATA

JSON
{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Numbers": [
      "20210330-180",
      "20210330-181"
    ],
    "Case Owner's Site": "Security Operations",
    "Case Reported Date": "2021-01-26 00:00:00",
    "Case Type": "Criminal Investigation",
    "Case Lead Investigators": "admin user",
    "Case Priority": "3",
    "Case Timezone": "(GMT-08:00) Pacific Standard Time",
    "Copy Form Data": "Yes",
    "Username": "admin user"
  }
}

Response

Response Fields

Field Name

Type

Description

error

string

The error message if the API request has failed.

returnData

string

The return data from the API request.

contextData

array<JSON Object>

The context data from the API request.

Sample Response

JSON
{
    "error": "",
    "returnData": "20210330-16",
    "contextData": [
      {
          "IncidentNumber": "20210330-180",
          "LinkedCaseNumber": "20210330-16",
          "UpdatedForm": [
              {
                  "ID": 223,
                  "Name": "ABC 01"
              },
              {
                  "ID": 1112,
                  "Name": "MySection"
              }
          ]
      },
      {
          "IncidentNumber": "20210330-181",
          "LinkedCaseNumber": "20210330-16",
          "UpdatedForm": [
              {
                  "ID": 223,
                  "Name": "ABC 01"
              },
              {
                  "ID": 1112,
                  "Name": "MySection"
              }
          ]
      }
  ]
}
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.