IBM Security Resilient

Expand all | Collapse all

Fields required to create incident

  • 1.  Fields required to create incident

    Posted 7 days ago
    Hi,

    I want to know what are mandatory fields to create an incident. 

    Is orgId need to create an incident? Can we create organisation if so how? I don't see any rest api for it.
    Is there any api to fetch the list of org?

    Thanks in advance

    ------------------------------
    Tejashwini Ingalagi
    ------------------------------


  • 2.  RE: Fields required to create incident

    Posted 3 days ago
    Organizations are created from the command line of the Resilient application. There is currently no API to get the org list (except for MSSP organizations if you use the configuration organization -- if you're not an MSSP that isn't relevant).

    The Types endpoint is the one that provides metadata about fields in the system. The following curl call gets the metadata about incidents:

    curl 'http://localhost:8080/rest/orgs/253/types/1?include_principals=false' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:76.0) Gecko/20100101 Firefox/76.0' -H 'Accept: */*' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Content-Type: application/json' -H 'X-sess-id: 1fdf017c7c680e7bff456923ad87db2a' -H 'handle_format: ids' -H 'text_content_output_format: objects_convert' -H 'browser_locale: en' -H 'X-Requested-With: XMLHttpRequest' -H 'Connection: keep-alive' -H 'Referer: http://localhost:8080/' -H 'Cookie: ISCReqURLv2=https%3A%2F%2Flocalhost%3A9444%2Fconsole%2Fhomepage; JSESSIONID=3E3821A4F4DDC553225FF3EEC78382D1; CSRF_TOKEN=7b2276616c7565223a223834653265653131333534353037363332393661343461396162363739643332227d'

    This returns something like this:

        "team": {
          "id": 143,
          "name": "team",
          "text": "Team",
          "prefix": "properties",
          "type_id": 0,
          "tooltip": "",
          "placeholder": "",
          "input_type": "multiselect",
          "required": "always",
          "hide_notification": false,
          "chosen": false,
          "default_chosen_by_server": false,
          "blank_option": false,
          "internal": false,
          "uuid": "fcf5a5be-9861-40d4-93e5-abb511cfb0b1",
          "operations": [
            "equals",
            "not_equals",
            "contains",
            "not_contains",
            "in",
            "not_in",
            "changed",
            "value_added",
            "has_a_value",
            "not_has_a_value"
          ],
          "operation_perms": {
            "changed": {
              "show_in_manual_actions": false,
              "show_in_auto_actions": true,
              "show_in_notifications": true
            },
            "not_has_a_value": {
              "show_in_manual_actions": true,
              "show_in_auto_actions": true,
              "show_in_notifications": true
            },
            "equals": {
              "show_in_manual_actions": true,
              "show_in_auto_actions": true,
              "show_in_notifications": true
            },
            "not_in": {
              "show_in_manual_actions": true,
              "show_in_auto_actions": true,
              "show_in_notifications": true
            },
            "in": {
              "show_in_manual_actions": true,
              "show_in_auto_actions": true,
              "show_in_notifications": true
            },
            "not_equals": {
              "show_in_manual_actions": true,
              "show_in_auto_actions": true,
              "show_in_notifications": true
            },
            "not_contains": {
              "show_in_manual_actions": true,
              "show_in_auto_actions": true,
              "show_in_notifications": true
            },
            "value_added": {
              "show_in_manual_actions": false,
              "show_in_auto_actions": true,
              "show_in_notifications": true
            },
            "has_a_value": {
              "show_in_manual_actions": true,
              "show_in_auto_actions": true,
              "show_in_notifications": true
            },
            "contains": {
              "show_in_manual_actions": true,
              "show_in_auto_actions": true,
              "show_in_notifications": true
            }
          },
          "values": [
            {
              "value": 306,
              "label": "Red Sox",
              "enabled": true,
              "properties": null,
              "uuid": "5bb0de27-1b9d-4ed1-8a9f-6b85338ccfcf",
              "hidden": false,
              "default": true
            },
            {
              "value": 307,
              "label": "Patriots",
              "enabled": true,
              "properties": null,
              "uuid": "c9061dd9-2adf-456e-89a3-e3460bfd8359",
              "hidden": false,
              "default": false
            },
            {
              "value": 308,
              "label": "Bruins",
              "enabled": true,
              "properties": null,
              "uuid": "13bcf7e3-3221-459a-bb6f-43ecb29b43a5",
              "hidden": false,
              "default": false
            },
            {
              "value": 309,
              "label": "Celtics",
              "enabled": true,
              "properties": null,
              "uuid": "fbbc0f55-72f0-40ed-ad33-f2b869a4949b",
              "hidden": false,
              "default": false
            }
          ],
          "perms": {
            "delete": true,
            "modify_name": true,
            "modify_values": true,
            "modify_blank": true,
            "modify_required": true,
            "modify_operations": true,
            "modify_chosen": true,
            "modify_default": true,
            "show_in_manual_actions": true,
            "show_in_auto_actions": true,
            "show_in_notifications": true,
            "show_in_scripts": true,
            "modify_type": [
              "multiselect"
            ],
            "sort": false
          },
          "read_only": false,
          "changeable": true,
          "rich_text": false,
          "templates": [],
          "deprecated": false,
          "tags": [],
          "calculated": false,
          "is_tracked": false,
          "allow_default_value": false
        },​


    Notice the required field has the value always. Some fields are only required on close. Some fields are not required.

    Ben


    ------------------------------
    Ben Lurie
    ------------------------------