REST API call to assign status to an incident

Using the REST API call, you can assign a status ID to an incident.

https://<epo_server_name:port>/rest/dlp/incidents/setStatus/{incidentId}?incidentNature={incidentNature}&statusId={statusId}

Where

epo_server_name:port is the server IP address and port number.
incidentId = {n} unique identifier of an incident.
incidentNature={n} n can be 1, 2, or 3 for incidents of different data vectors (incident nature).
statusId status ID that has to be set to an incident

Parameter name	Description	Required	Values
Authorization	User credentials for ePO - On-prem.	Required
incidentId={n}	Unique identifier of an incident	Required	Number
statusId	Status IDs. Options can be: "2": "NEW", "3": "PENDING", "4": "VIEWED", "5": "UNDER_INVESTIGATION", "6": "ESCALATED", "7": "RESOLVED", "8": "FALSE_POSITIVE", "201": "SUSPENDED", "202": "ARCHIVED", "203": "OPENED", "204": "SUPPRESSED"
incidentNature={n}	Incidents generated for data-in-use/motion and data-at-rest can have the same incident IDs. Specify n to differentiate the incident nature. Based on the data vectors, {n} can be: 1 = Retrieve incident details generated for data-in-use/motion 2 = Reserved to retrieve data-at-rest - Endpoint Discovery incidents and can be used when support for Endpoint Discovery custom attributes is added into the product 3 = Retrieve incident details generated for data-at-rest - Network	Required	Number

In these sample API calls, incident 209 generated for data-in-use/motion is assigned with the status ID 4.

Sample PUT request URL

https://172.27.108.53:8443/rest/dlp/incidents/setStatus/209?incidentNature=1&statusId=4

Sample cURL command

curl -k -v -X PUT 'https://172.27.108.53:8443/rest/dlp/incidents/setStatus/209?incidentNature=1&statusId=4' -u '<user>:<password>'

The response returns a message.

Element		Description	Data type
Message		Shows whether the status is updated successfully to the required incident.	String

Status updated for the incident

List of HTTP status codes returned for the query.

Code	Description
200 OK	Returns whether the status is updated.
400 Bad Request	Returns a bad request if: statusId is missing or invalid incidentNature is missing. incidentNature has a non-numeric value. incidentNature is not either 1 or 3.
404 Not Found	Incorrect ePO - On-prem URL.
405 Not Allowed	Incident is read only.
500 Internal Server Error	An error on the server side that failed the request. See the ePO - On-prem `orion.log` file for more details about the error.