Cisco XDR: Incident

Adds a new note to an existing incident in Cisco XDR.

Target: Platform APIs

Steps:
[] Generate the JSON for the new note
[] Request the note be created
[] Check if the request was successful:
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/post-a-note-to-private-intel

XDR - Incident - Add Note to Incident

prod-nam

prod-eu

prod-apjc

Creates a new incident in Cisco XDR.

Target: Platform APIs

Steps:
[] Build the incident object
[] Build the incident bundle
[] Import the incident bundle into XDR
[] Check if the request was successful:
[]> If it was, attempt to extract the incident ID and set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/post-many-new-entities-using-a-single-http-call/

XDR - Incident - Create Incident

Fetches a list of events related to an incident from Cisco XDR.

Target: Conure APIs

Steps:
[] Extract the simple incident ID
[] Request the incident's events from Cisco XDR
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/returns-a-list-of-events-linked-to-this-incident/

XDR - Incident - Get Incident Events

Fetches a list of events related to an incident from Cisco XDR. This updated atomic supports using a large string for output so more events can be handled without the variable size limit being reached.

Target: Conure APIs

Steps:
[] Extract the simple incident ID
[] Check if an event limit was provided (if so, build the query string)
[] Request the incident's events from Cisco XDR
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

XDR - Incident - Get Incident Events (v2)

Fetches a list of indicators related to an incident from Cisco XDR.

Target: Conure APIs

Steps:
[] Extract the simple incident ID
[] Request the incident's indicators from Cisco XDR
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/returns-a-list-of-indicators-linked-to-this-incident/

XDR - Incident - Get Incident Indicators

Fetches a list of observables related to an incident from Cisco XDR.

Target: Conure APIs

Steps:
[] Extract the simple incident ID
[] Request the incident's observables from Cisco XDR
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/returns-a-list-of-observables-linked-to-this-incident/

XDR - Incident - Get Incident Observables

Fetches a summary of an incident from Cisco XDR.

Target: Conure APIs

Steps:
[] Extract the simple incident ID
[] Request the incident summary from Cisco XDR
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/full-incident-summary-equivalent-data-to-v1-summary-endpoints/

XDR - Incident - Get Incident Summary

XDR - Incident - Get Incident Summary (v2)

Fetches a list of targets related to an incident from Cisco XDR.

Target: Conure APIs

Steps:
[] Extract the simple incident ID
[] Request the incident's events from Cisco XDR
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/incident-assets/

XDR - Incident - Get Incident Targets

Links an incident to another object in Cisco XDR. Incidents can be linked to casebooks, investigations, or other incidents.

Target: Conure APIs

Steps:
[] Extract the incident ID
[] Extract the object ID
[] Validate that extraction was successful (if not, end the workflow)
[] Validate the object type is valid (if not, end the workflow)
[] Request the object be linked to the incident
[] Check if the request was successful:
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/link-incident-and-entity-investigation-casebook-incident/

XDR - Incident - Link Object

Searches for incidents in your Cisco XDR private intelligence store.

Target: Platform APIs

Steps:
[] Build the query string
[] Request incidents from Cisco XDR
[] Check if the request was successful:
[]> If it was, set the output variable
[]> If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/search-incidents-in-private-intel-incidents-enriched-with-enrichment_status-when-available/

XDR - Incident - Search Incidents

Updates an incident's properties in your Cisco XDR private intelligence store.

Target: Platform APIs or Private Intelligence API (deprecated)

Steps:
- Extract the simple incident ID
- Build the request URL
- Build the request payload
- Update the incident's properties
- Check if the request was successful:
  - If it was, set the output variable
  - If it wasn't, return an error

More information about this API: https://developer.cisco.com/docs/cisco-xdr/patch-an-incident-in-private-intel/