REST API call to assign severity to an incident

You can assign a severity ID to an incident.

https://<epo_server_name:port>/rest/dlp/incidents/setSeverity/{incidentId}?incidentNature={incidentNature}&severityId={severityId}

Where

epo_server_name:port is the server IP address and port number.
incidentNature={n} n can be 1, 2, or 3 for incidents of different data vectors (incident nature).
{incidentId} unique identifier of an incident.
{severityId} new severity that has to be set to an incident

Parameter name	Description	Required	Values
Authorization	User credentials for ePO - On-prem.	Required
{incidentId}	Unique identifier of an incident	Required	Number
{severityId}	Severity ID that has to be set to an incident. Options can be: "0": "INFO" "1": "WARNING" "2": "MINOR" "3": "MAJOR" "4": "CRITICAL"	Required	Number
incidentNature={n}	Incidents generated for data-in-use/motion and data-at-rest can have the same incident IDs. Specify n to differentiate the incident nature. Based on the data vectors, {n} can be: 1 = Retrieve incident details generated for data-in-use/motion 2 = Reserved to retrieve data-at-rest - Endpoint Discovery incidents and can be used when support for Endpoint Discovery custom attributes is added into the product 3 = Retrieve incident details generated for data-at-rest - Network	Required	Number

Using these sample API calls, incident 209 generated for data-in-use/motion is assigned with the severity ID 2.

Sample PUT request URL

https://172.27.108.53:8443/rest/dlp/incidents/setSeverity/209?incidentNature=1&severityId=2

Sample cURL command

curl -k -v -X PUT 'https://172.27.108.53:8443/rest/dlp/incidents/setSeverity/209?incidentNature=1&severityId=2' -u '<user>:<password>'

Response returns a message.

Element		Description	Data type
Message		Shows whether the severity is updated successfully to the required incident.	String

Severity updated for the incident

List of HTTP status codes returned for the query.

Code	Description
200 OK	Returns whether the severity is updated.
400 Bad Request	Returns a bad request if: severityId is missing or invalid. incidentNature is missing. incidentNature has a non-numeric value. incidentNature is not either 1 or 3.
404 Not Found	Incorrect ePO - On-prem URL.
405 Not Allowed	Incident is read only.
500 Internal Server Error	An error on the server side that failed the request. See the ePO - On-prem `orion.log` file for more details about the error.