REST API call to assign incidents to a case

Using this API call, you can assign incidents and case details to a newly created case. You can assign the priority, status, resolution, owner, and case title in this request.

POST request URL

https://<epo_server_name:port>/rest/dlp/incidents/addToNewCase?incidentNature={n}

Where

epo_server_name:port is the server IP address and port number.
incidentNature={n} n can be 1, 2, or 3 for incidents of different data vectors (incident nature). Based on the value of n specified, incident of the specified incident type is assigned to a case.

Request Parameters

Parameter name	Description	Required	Values
Authorization	User credentials for ePO - On-prem.	Required
incidentNature={n}	Incidents generated for data-in-use/motion and data-at-rest can have the same incident IDs. Specify n to differentiate the incident nature. Based on the data vectors, {n} can be: 1 = Retrieve incident details generated for data-in-use/motion 2 = Reserved to retrieve data-at-rest - Endpoint Discovery incidents and can be used when support for Endpoint Discovery custom attributes is added into the product 3 = Retrieve incident details generated for data-at-rest - Network	Required	Number
Case elements
incidentId	Unique identifier of an incident. Enter a comma-separated list for specifying multiple incidents.	Required	Number
caseTitle	Specifies the case title	Required
caseResolution	Specifies the resolution of the case	Optional	String
caseStatus	Specifies the status of the case	Optional	String
casePriority	Specifies the priority of the case	Optional	String
caseOwner	Specifies the case owner group. (Group ID must be passed with prefix G. For example, G1)	Optional	String
caseOwner	Specifies the case owner user. (User ID must be passed with prefix U. For example, U7)	Optional	String

Sample POST request URL

In this sample POST request, incident 13 generated for data-at-rest - Network is assigned to TestCase2 with the other case details as specified.

https://172.27.108.53:8443/rest/dlp/incidents/addToNewCase?incidentNature=3

Payload

{

"incidentIds" : "13",

"caseTitle" : "TestCase2",

"caseOwner" : "",

"casePriority" : "3",

"caseStatus" : "3",

"caseResolution" : "3"

}

Sample cURL command

In this sample POST request, incident 14 generated for data-at-rest - Network is assigned to TestCase2 with the other case details as specified.

curl -k -v -X POST 'https://172.27.108.53:8443/rest/dlp/incidents/addToNewCase?incidentNature=3' -u '<user>:<password>'

--data-raw

'{

"incidentIds": "14",

"caseTitle": "TestCase2",

"caseOwner": "U8",

"casePriority": "2",

"caseStatus": "2",

"caseResolution": "2"

}'

If caseOwner, casePriority, caseStatus, and caseResolution aren't specified, the default values are added and saved to the database.

If caseOwner, CasePriority, CaseStatus and caseResolution are specified in the User Interface, these are considered as the default values. If the default values for case resolution and case status are disabled in Case Management under DLP Settings, the default value will be first row in the dropdown list, which is sorted in ascending order.

Response parameters

The response returns a message about the assignment of an incident to a case.

Element		Description	Data type
Message		Shows whether an incident is added successfully or not to a case.	String

Sample response

Incident added successfully to newly added case TestCase2 : Incident Ids 13

Status and error codes

List of HTTP status codes returned for the query.

Code	Description
200 OK	Returns a string stating that the incident is added successfully to the newly created case.
404 Not Found	Incorrect ePO - On-prem URL.
500 Internal Server Error	An error on the server side that failed the request. See the ePO - On-prem `orion.log` file for more details about the error.