Update Dynamic Form Value by Incident Number

Sets the values of specified incident dynamic fields in all instances in a given incident's dynamic section by conditions.

Implementation	System
Command Category	System Utility
Tags	INCIDENT INCIDENT DYNAMIC FORM

Inputs

Parameter Name	Required/Optional	Description	Sample Data
Incident Number	Optional	The number of incident to update on.	`20200530-303`
Section Name	Optional	The name of the dynamic section.	`MySection`
Conditions	Optional	Conditions for filtering dynamic form instances in the specified dynamic section.	CODE `{ "FirstName": "Bob", "LastName": "James" }`
Field Values	Optional	Field and value pairs for setting the incident dynamic fields.	CODE `{ "Email": "user01@example.com", "PhoneNumber": "6040000000" }`

Output

Key Fields

Important key-value pairs extracted from Raw Data.

SAMPLE DATA

JSON

{
  "IncidentNumber": "20200530-303",
  "ModifiedDate": "5/30/2020 10:01:26 AM",
  "ModifiedBy": "admin user"
}

Return Data

The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.

SAMPLE DATA

JSON

Succeed

Context Data

The response data from the utility command.

SAMPLE DATA

JSON

{
    "incidentNumber": "20200530-303",
    "sectionName": "MySection",
    "condition": {
        "FirstName": "Bob",
        "LastName": "James"
    },
    "fieldAndValue": {
        "Email": "user01@example.com",
        "PhoneNumber": "6040000000"
    },
    "modifiedDate": "5/30/2020 10:01:26 AM",
    "result": "Succeed",
    "modifiedBy": "admin user"
}

Remote Command API

The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.

Request

POST

CODE

https:/{base_url}/{api_namespace}/api/Command/UpdateDynamicFieldsByNumber

Headers

Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.

Request Body

JSON

{
  "Username": "<Username here>",
  "Site": "<Site here>",
  "CommandParams": {
    "Incident Number": "<Incident Number here>",
    "Section Name": "<Section Name here>",
    "Conditions": "<Conditions here>",
    "Field Values": "<Field Values here>"
  }

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`String`	Required	The username of your D3 SOAR account.
Site	`String`	Required	The D3 SOAR site to run the remote command.
Incident Number	`Text`	Optional	The number of incident to update on.
Section Name	`Text`	Optional	The name of the dynamic section.
Conditions	`JSON Object`	Optional	Conditions for filtering dynamic form instances in the specified dynamic section.
Field Values	`JSON Object`	Optional	Field and value pairs for setting the incident dynamic fields.

Sample Request

SAMPLE DATA

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Number": "20200530-303",
    "Section Name": "MySection",
    "Conditions": {
      "FirstName": "Bob",
      "LastName": "James"
    },
    "Field Values": {
      "Email": "user01@example.com",
      "PhoneNumber": "6040000000"
    }
  }

Response

Response Fields

Field Name	Type	Description
error	`Text`	The error message if the API request has failed.
keyFields	`JSON Object`	The key fields from the API request.
returnData	`Text`	The return data from the API request.
contextData	`JSON Object`	The context data from the API request.

Sample Response

JSON

{
    "error": "",
    "keyFields": {
      "IncidentNumber": "20200530-303",
      "ModifiedDate": "5/30/2020 10:01:26 AM",
      "ModifiedBy": "admin user"
    },
    "returnData": "Succeed",
    "contextData": {
        "incidentNumber": "20200530-303",
        "sectionName": "MySection",
        "condition": {
            "FirstName": "Bob",
            "LastName": "James"
        },
        "fieldAndValue": {
            "Email": "user01@example.com",
            "PhoneNumber": "6040000000"
        },
        "modifiedDate": "5/30/2020 10:01:26 AM",
        "result": "Succeed",
        "modifiedBy": "admin user"
    }
}