Update Incidents' Owner In Bulk
LAST UPDATED: AUG 29, 2024
Updates the owners of multiple incidents based on the provided incident numbers and owner name.
Implementation | System |
Command Category | System Utility |
Tags | INCIDENT INCIDENT FIELDS |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Incident Numbers | Optional | The array of incident numbers corresponding to the incidents whose owner will be updated. | [20210127-198,20210127-197] |
Owner | Optional | The name of the new owner of the incidents. | admin user |
Username | Optional | The username of the user performing the update. This username will be used only when the task is run automatically. | admin user |
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/UpdateIncidentOwnerInBulk
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": "<Username here>",
"Site": "<Site here>",
"CommandParams": {
"Incident Numbers": "<Incident Numbers here>",
"Owner": "<Owner here>",
"Username": "<Username here>"
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Incident Numbers |
| Required | The array of incident numbers corresponding to the incidents whose owner will be updated. |
Owner |
| Required | The name of the new owner of the incidents. |
Username |
| Optional | The username of the user performing the update. This username will be used only when the task is run automatically. |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Incident Numbers": "[20210127-198,20210127-197]",
"Owner": "admin user",
"Username": "admin user"
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
returnData |
| The return data from the API request. |
contextData |
| The context data from the API request. |
Sample Response
{
"error": "",
"returnData": "Successful",
"contextData": [
{
"Incident Number": "20210127-198",
"Incident Owner": "admin user",
"Result": "Successful"
},
{
"Incident Number": "20210127-197",
"Incident Owner": "admin user",
"Result": "Successful"
}
]
}