REST API call to assign incidents to an existing case

Using this API call, you can assign incidents to an existing case.

https://<epo_server_name:port>/rest/dlp/incidents/addToCase?incidentNature={n}

Where

epo_server_name:port is the server IP address and port number.
incidentNature={n} n can be 1, 2, or 3 for incidents of different data vectors (incident nature). Based on the value of n specified, incidents of the specified incident type are added to a case.

Parameter name	Description	Required	Values
Authorization	User credentials for Trellix ePO - On-prem.	Required
incidentNature={n}	Incidents generated for data-in-use/motion and data-at-rest can have the same incident IDs. Specify n to differentiate the incident nature. Based on the data vectors, {n} can be: 1 = Retrieve incident details generated for data-in-use/motion 2 = Reserved to retrieve data-at-rest - Endpoint Discovery incidents and can be used when support for Endpoint Discovery custom attributes is added into the product 3 = Retrieve incident details generated for data-at-rest - Network	Required	Number
Case elements
caseId	case ID	Required	String
incidentIds	Unique identifier of an incident. Enter a comma-separated list for specifying multiple incidents.	Required	String

In these sample requests, incidents 13 and 24 generated for data-at-rest - Network are assigned to case ID 7.

Sample PUT request URL

https://172.27.108.53:8443/rest/dlp/incidents/addToCase?incidentNature=3

Payload

{

"incidentIds": "13,24",

"caseId": "7"

}

Sample cURL command

curl -k -v -X PUT 'https://172.27.108.53:8443/rest/dlp/incidents/addToCase?incidentNature=3' -u '<user>:<password>'

--data-raw

'{

"incidentIds": "13,24",

"caseId": "7"

}'

The response returns a message about the assignment of incidents to a case.

Element		Description	Data type
Message		Shows whether incidents are added successfully or not to a case.	String

Incident added successfully to existing case 7

List of HTTP status codes returned for the query.

Code	Description
200 OK	Returns a response stating that the incidents are added successfully to the specified case.
400 Bad Request	Returns a bad request if: incidentNature is missing or has a non-numeric value. incidentIds are missing or has a non-numeric value.
404 Not Found	Incorrect ePO - On-prem URL.
500 Internal Server Error	An error on the server side that failed the request. See the ePO - On-prem `orion.log` file for more details about the error.