Set Custom Data in Incident Raw Data
This Utility command allows you to set CustomData in Incident Raw Data.
Reader Note
Please note that this command is only applicable within an incident Playbook.
Implementation | System |
Command Category | System Utility |
Tags | INCIDENT INCIDENT RAW DATA |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Data | Optional | Data to set customData in Incident Raw Data. |
CODE
|
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/SetCustomDataInIncidentRawData
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": "<Username here>",
"Site": "<Site here>",
"CommandParams": {
"data": "<data here>""
}
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Data |
| Optional | Data to set customData in Incident Raw Data. |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"data": {
"Client Info": {
"Name": "Client A"
}
}
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
keyFields |
| The key fields from the API request. |
returnData |
| The return data from the API request. |
contextData |
| The context data from the API request. |
Sample Response
{
"error": "",
"keyFields": {
"IncidentNumber": "20200527-244",
"data": {
"Client Info": {
"Name": "Client A"
}
},
"ModifiedDate ": "5/27/2020 3:00:55 PM",
"Result": "Succeed",
"ModifiedBy ": "admin user"
},
"returnData": "Succeed",
"contextData": {
"IncidentNumber": "20200527-244",
"CustomData": {
"Client Info": {
"Name": "Client A"
}
},
"ModifiedDate": "5/27/2020 3:00:55 PM",
"Result": "Succeed",
"ModifiedBy": "admin user"
}
}