Link Incidents to A New Case

Last updated: SEPT 04, 2024

Creates a new case and adds the provided incidents to it. The command defaults to adding the current runtime incident to the new case if no specific incident number is provided.

Implementation	System
Command Category	System Utility
Tags	Incident Incident Linking

Inputs

Parameter Name	Required/Optional	Description	Sample Data
Incident Numbers	Required	The array of incident numbers of incidents which will be linked to a new case.	`[ "20210330-180", "20210330-181" ]`
Case Owner's Site	Required	The owner's site of the new case.	Security Operations
Case Reported Date	Required	The reported date of the new case.	2021-01-26 00:00:00
Case Type	Required	The case type of the new case.	Criminal Investigation
Case Lead Investigators	Required	The lead investigator of the new case.	admin user
Case Priority	Required	The priority level of the new case.	"3"
Case Timezone	Required	The time zone of the new case.	(GMT-08:00) Pacific Standard Time
Copy Form Data	Optional	Whether or not to copy incidents' form data to the newly linked case.	Yes
Username	Required	The username of user who links incidents to a new case. This username will be used only when the task is run automatically.	admin user

Output

Return Data

The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.

Sample Data

JSON

20210330-16

Context Data

The response data from the utility command.

Sample Data

JSON

[
    {
        "IncidentNumber": "20210330-180",
        "LinkedCaseNumber": "20210330-16",
        "UpdatedForm": [
            {
                "ID": 223,
                "Name": "ABC 01"
            },
            {
                "ID": 1112,
                "Name": "MySection"
            }
        ]
    },
    {
        "IncidentNumber": "20210330-181",
        "LinkedCaseNumber": "20210330-16",
        "UpdatedForm": [
            {
                "ID": 223,
                "Name": "ABC 01"
            },
            {
                "ID": 1112,
                "Name": "MySection"
            }
        ]
    }
]

Remote Command API

The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.

Request

POST

https:/{base_url}/{api_namespace}/api/Command/LinkIncidentsToNewCase

Headers

Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.

Request Body

JSON

{
  "Username": "<Username here>",
  "Site": "<Site here>",
  "CommandParams": {
    "Incident Numbers": "<Incident Numbers here>",
    "Case Owner's Site": "<Case Owner's Site here>",
    "Case Reported Date": "<Case Reported Date here>",
    "Case Type": "<Case Type here>",
    "Case Lead Investigators": "<Case Lead Investigators here>",
    "Case Priority": "<Case Priority here>",
    "Case Timezone": "<Case Timezone here>",
    "Copy Form Data": "<whether to Copy Form Data>",
    "Username": "<Username here>"
  }
}

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Incident Numbers	`array<string>`	Required	The array of incident numbers of incidents which will be linked to a new case.
Case Owner's Site	`string`	Required	The owner's site of the new case.
Case Reported Date	`string`	Required	The reported date of the new case.
Case Type	`string`	Required	The case type of the new case.
Case Lead Investigators	`string`	Required	The lead investigator of the new case.
Case Priority	`string`	Required	The priority level of the new case.
Case Timezone	`string`	Required	The time zone of the new case.
Copy Form Data	`string`	Optional	Whether or not to copy incidents' form data to the newly linked case.
Username	`string`	Required	The username of user who links incidents to a new case. This username will be used only when the task is run automatically.

Sample Request

Sample Data

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Incident Numbers": [
      "20210330-180",
      "20210330-181"
    ],
    "Case Owner's Site": "Security Operations",
    "Case Reported Date": "2021-01-26 00:00:00",
    "Case Type": "Criminal Investigation",
    "Case Lead Investigators": "admin user",
    "Case Priority": "3",
    "Case Timezone": "(GMT-08:00) Pacific Standard Time",
    "Copy Form Data": "Yes",
    "Username": "admin user"
  }
}

Response

Response Fields

Field Name	Type	Description
error	`string`	The error message if the API request has failed.
returnData	`string`	The return data from the API request.
contextData	`array<JSON Object>`	The context data from the API request.

Sample Response

JSON

{
    "error": "",
    "returnData": "20210330-16",
    "contextData": [
      {
          "IncidentNumber": "20210330-180",
          "LinkedCaseNumber": "20210330-16",
          "UpdatedForm": [
              {
                  "ID": 223,
                  "Name": "ABC 01"
              },
              {
                  "ID": 1112,
                  "Name": "MySection"
              }
          ]
      },
      {
          "IncidentNumber": "20210330-181",
          "LinkedCaseNumber": "20210330-16",
          "UpdatedForm": [
              {
                  "ID": 223,
                  "Name": "ABC 01"
              },
              {
                  "ID": 1112,
                  "Name": "MySection"
              }
          ]
      }
  ]
}