IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

How can I retrieve Incident ID from an incident just created successfully through Resilient Circuits API?

  • 1.  How can I retrieve Incident ID from an incident just created successfully through Resilient Circuits API?

    Posted Mon March 28, 2022 08:00 AM
    Hi everybody

    I am working on an integration that reads from a source and use retrieved details to create an incident and upload relevant artefacts to the incident. We are using resilient-circuits so I am using its API for ticket creation(res_client = self.rest_client()), however I have problems retrieving the incident id of the incident just created to upload artefacts through resilient-circuits API.
    I tried to retrieve it the API returned payload, it seems it is not included. I tried to use incident_id as an input with pre-process value of incidnet.id (inputs.incident_id=incident.id) and it rather returns the incident id of the incident I used to fire my rule and test the function.
    I wondered if anyone can help with explaining how I can retrieve the incident id for the incident just created through resilient-circuits API, so I can use it for uploading the artefacts to the incident?

    Thank you

    ------------------------------
    Mohammad Tari
    ------------------------------


  • 2.  RE: How can I retrieve Incident ID from an incident just created successfully through Resilient Circuits API?

    Posted Tue March 29, 2022 08:05 AM
    It might be helpful to show the code that is creating the new incident. Specifically the API being used would be helpful.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------

    Original Message


Related Content