REST API call to assign custom attributes to an incident

Assign custom attributes to an incident using the customAttribute/{incidentId} PUT API call.

PUT request URL

https://<epo_server_name:port>/rest/dlp/incidents/customAttribute/{incidentId}?incidentNature={n}

Where

epo_server_name:port is the server IP address and port number.
customAttribute/{incidentId} ID of the incident to which you want to assign custom attributes.
incidentNature={n} incidents generated for data-in-use/motion and data-at-rest can have the same incident IDs. Specify n to differentiate the incident type.

This call assigns custom attributes to the specified incident. You can use a user-defined automation script to assign custom attributes to all incidents in batches.

Request Parameters

Use the query parameters to return the incident details.

Parameter name	Description	Required	Values
Authorization	User credentials for ePO - On-prem	Required
Body (Raw)	A JSON object array that has "id" and "value" as the key: value pair. "id" is the value returned from `customAttribute/list` call and "value" is the value for the custom attribute for the given incident ID. Example — `[{"id":"5","value":"David"},{"id":"6","value":"John"}]`	Required	application/JSON
incidentNature={n}	Incidents generated for data-in-use/motion and data-at-rest can have the same incident IDs. Specify n to differentiate the incident nature. Where {n} can be: 1 = Assign attributes to an incident generated for data-in-use/motion 2 = Reserved to assign attributes to data-at-rest - Endpoint Discovery incidents and can be used when support for Endpoint Discovery custom attributes is added into the product 3 = Assign attributes to an incident generated for data-at-rest - Network	Required	Number

Parameter name

Description

Required

Values

Authorization

User credentials for ePO - On-prem

Required

Body (Raw)

A JSON object array that has "id" and "value" as the key: value pair. "id" is the value returned from customAttribute/list call and "value" is the value for the custom attribute for the given incident ID.

Example — [{"id":"5","value":"David"},{"id":"6","value":"John"}]

Required

application/JSON

incidentNature={n}

Incidents generated for data-in-use/motion and data-at-rest can have the same incident IDs. Specify n to differentiate the incident nature.

Where {n} can be:

1 = Assign attributes to an incident generated for data-in-use/motion
2 = Reserved to assign attributes to data-at-rest - Endpoint Discovery incidents and can be used when support for Endpoint Discovery custom attributes is added into the product
3 = Assign attributes to an incident generated for data-at-rest - Network

Required

Number

Sample PUT request URL

https://172.27.108.53:8443/rest/dlp/incidents/customAttribute/18?incidentNature=1

Sample cURL command

curl -k -v -X PUT 'https://ePO-url:ePO-port/rest/dlp/incidents/customAttribute/18?incidentNature=1' -u '<user>:<password>' --header 'Content-Type: application/json' --data-raw '[{"id":"5","value":"David"},{"id":"6","value":"John"}]'

Response parameters

Response parameters

Element		Description	Data type
id		Custom attribute ID. This ID is the value retrieved using the `customAttribute/list` call.	string
value		Is the value that you assign to custom attributes. Custom attributes expect a one-to-one mapping of values and the same custom attribute assigned to different incidents can have different values.	string

Sample response

If Body is:

[{"id":"5","value":"David"},{"id":"6","value":"John"}]

The sample response is as shown:

Custom attributes updated successfully with payload [
    {
        "id": "5",
        "value": "David"
    },
    {
        "id": "6",
        "value": "John"
    }
]

Status and error codes

List of HTTP status codes returned for a query.

Code	Description
200 OK	Returns the list of updated custom attributes for the specified incident.
400 Bad Request	Invalid or missing incident ID Missing attribute in JSON payload (ID and/or value) Malformed JSON in payload Non-numeric ID in payload Invalid or missing incidentNature value
404 Not Found	Incorrect ePO - On-prem URL Incident or attribute ID doesn't exist
500 Internal Server Error	An error on the server side which failed the request. See the ePO - On-prem `orion.log` file for more details about the error.