Update Incident Dynamic Field Values with Event Data
LAST UPDATED: AUG 29, 2024
Updates a dynamic field value of an incident with event data.
Implementation | System |
Command Category | System Utility |
Tags | INCIDENT INCIDENT DYNAMIC FORM |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Event Field Names | Optional | The event field names. |
CODE
|
Dynamic Section Name | Required | The name of a Section item within an incident form. | All Activities 123 |
Section Field Name | Required | The name of an Info Activity item within an incident form. | Text Area |
Incident Number | Required | The incident number associated with the target incident. | 20230206-2 |
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/UpdateIncidentDynamicFieldValuesWithEventData
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": "<Username here>",
"Site": "<Site here>",
"CommandParams": {
"Event Field Names": "<Event Field Names here>",
"Dynamic Section Name": "<Dynamic Section Name here>",
"Section Field Name": "<Section Field Name here>",
"Incident Number": "<Incident Number here>"
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Event Field Names |
| Optional | The event field names. |
Dynamic Section Name |
| Required | The name of a Section item within an incident form. |
Section Field Name |
| Required | The name of an Info Activity item within an incident form. |
Incident Number |
| Required | The incident number associated with the target incident. |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Event Field Names": [
"Severity",
"Event name",
"Direction",
"Device volume",
"Source translated IP address"
],
"Dynamic Section Name": "All Activities 123",
"Section Field Name": "Text Area",
"Incident Number": "20230206-2"
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
keyFields |
| The key fields from the API request. |
returnData |
| The return data from the API request. |
contextData |
| The context data from the API request. |
Sample Response
{
"error": "",
"keyFields": {
"IncidentNumber": "20230206-2",
"ModifiedDate": "2/6/2023 5:39:38 PM",
"ModifiedBy": "admin user"
},
"returnData": "Succeed",
"contextData": {
"incidentNumber": "20230206-2",
"sectionName": "All Activities 123",
"fieldAndValue": {
"Text Area": "<table class='cc-table vertical-table'><tr><th>Severity</th><td>[<br> "60"<br>]</td></tr><tr><th>Event name</th><td>[<br> "Bitcoin-related domain name queried by EC2 instance i-0406e39fb469745c9.",<br> "Task 40117 DT_2961 (D3MainApp.15.3) Details of 100 detections and 10 (later 100+) automation rules"<br>]</td></tr><tr><th>Direction</th><td>[]</td></tr><tr><th>Device volume</th><td>[<br> "arn:aws:ec2:us-east-2:391501681688:instance/i-0406e39fb469745c9"<br>]</td></tr><tr><th>Source translated IP address</th><td>[<br> "18.191.205.203, 10.10.0.116"<br>]</td></tr></table>"
},
"modifiedDate": "2/6/2023 5:39:38 PM",
"result": "Succeed",
"modifiedBy": "admin user"
}
}