REST API call to add comment to an incident

You can add comment to an incident, identified by the specified incident nature and its ID.

PUT request URL

https://<epo_server_name:port>/rest/dlp/incidents/comments/{incidentId}?incidentNature={n}

Where

epo_server_name:port is the server IP address and port number.
incidentNature={n} n can be 1, 2, or 3 for incidents of different data vectors (incident nature).
incidentId unique identifier of an incident for which you want to assign a comment.

Request Parameters

Parameter name	Description	Required	Values
Authorization	User credentials for ePO - On-prem.	Required
{incidentId}	Unique identifier of an incident.	Required	Number
incidentNature={n}	Incidents generated for data-in-use/motion and data-at-rest can have the same incident IDs. Specify n to differentiate the incident nature. Based on the data vectors, {n} can be: 1 = Retrieve incident details generated for data-in-use/motion 2 = Reserved to retrieve data-at-rest - Endpoint Discovery incidents and can be used when support for Endpoint Discovery custom attributes is added into the product 3 = Retrieve incident details generated for data-at-rest - Network	Required	Number

Sample PUT request URL

https://172.27.108.53:8443/rest/dlp/incidents/comments/17?incidentNature=3

Sample cURL command

curl -k -v -X PUT 'https://172.27.108.53:8443/rest/dlp/incidents/comments/17?incidentNature=3' -d '{"newComment":"This is a new test1 comment."}' -u '<user>:<password>'

Response parameters

The response returns a message.

Element		Description	Data type
Message		Shows whether a comment is added successfully or not to an incident.	String

Sample response

{
   Comment added successfully for inicidentId 17
}

Status and error codes

List of HTTP status codes returned for the query.

Code	Description
200 OK	Returns a message stating that a comment is added successfully to the specified incident.
400 Bad Request	Returns a bad request if: incidentNature is missing or has a non-numeric value. incidentId is missing or has non-numeric or non-existing value. newComment is missing.
404 Not Found	Incorrect ePO - On-prem URL.
500 Internal Server Error	An error on the server side that failed the request. See the ePO - On-prem `orion.log` file for more details about the error.