Entry
APIs for managing entries to the War Room
Create an entry to an existing incident War Room. Entries are written in Markdown format.
OK - Entry
Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined
The contents of the entry that is actually indexed - should not be used
ContentsSize the total size of the contents
Who has created this event - relevant only for manual incidents
EndingType holds the type of schedule Ending
Source of the error
Filename of associated content
FileID is the file name when saved in the server
Holds information on how content is formatted
Internal field to make queries on role faster
store the entry based on IncidentCreationTime
The id of the investigation it belongs to
IsTodo
Only used for outbound mirroring to mark that it is already mirrored to remote system
Note
ParentEntry content - for reference
ParentEntryTruncated - indicates weather entry content was truncated
ParentId is the ID of the parent entry
Mark entry as pinned = evidence
PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook
Only used for polling entries
Do not change this field manually
ReadOnly
ReputationSize the total size of the reputation
When retry took place
The role assigned to this investigation
is it scheduled
The name of the system associated with this entry
Tags
TagsRaw
TaskID - used if the entry is assigned as note to a playbook task
EntryType specifies the type of the entry
The user who created the entry
Precondition failed - Investigation is closed
POST /xsoar/public/v1/entry HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 489
{
"args": {
"ANY_ADDITIONAL_PROPERTY": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": [
{
"key": "text",
"value": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
}
}
],
"simple": "text"
}
},
"data": "text",
"id": "text",
"investigationId": "text"
}{
"id": "42091112-0341-427a-87f0-586bf6ea5e78@157448",
"version": 1,
"cacheVersn": 0,
"modified": "2024-02-21T13:08:42.219718696Z",
"sizeInBytes": 0,
"dbotCreatedBy": "ishestakov@paloaltonetworks.com",
"type": 1,
"created": "2024-02-21T13:08:42.219700522Z",
"incidentCreationTime": "2024-02-21T13:08:42.219700522Z",
"investigationCreationTime": "2024-02-21T09:41:41.293Z",
"retryTime": "0001-01-01T00:00:00Z",
"user": "",
"errorSource": "",
"contents": "test message",
"format": "markdown",
"investigationId": "157448",
"file": "",
"fileID": "",
"parentId": "",
"pinned": false,
"fileMetadata": null,
"parentContent": null,
"parentEntryTruncated": false,
"system": "",
"reputations": null,
"category": "chat",
"note": false,
"isTodo": false,
"tags": null,
"tagsRaw": null,
"startDate": "0001-01-01T00:00:00Z",
"times": 0,
"recurrent": false,
"endingDate": "0001-01-01T00:00:00Z",
"timezoneOffset": 0,
"cronView": false,
"scheduled": false,
"scheduledEntryGuid": "",
"entryTask": null,
"taskId": "",
"playbookId": "",
"reputationSize": 0,
"contentsSize": 12,
"brand": "none",
"InstanceID": "",
"IndicatorTimeline": null,
"Relationships": null,
"mirrored": false
}Mark an entry as a note or delete a note.
OK
Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined
The contents of the entry that is actually indexed - should not be used
ContentsSize the total size of the contents
Who has created this event - relevant only for manual incidents
EndingType holds the type of schedule Ending
Source of the error
Filename of associated content
FileID is the file name when saved in the server
Holds information on how content is formatted
Internal field to make queries on role faster
store the entry based on IncidentCreationTime
The id of the investigation it belongs to
IsTodo
Only used for outbound mirroring to mark that it is already mirrored to remote system
Note
ParentEntry content - for reference
ParentEntryTruncated - indicates weather entry content was truncated
ParentId is the ID of the parent entry
Mark entry as pinned = evidence
PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook
Only used for polling entries
Do not change this field manually
ReadOnly
ReputationSize the total size of the reputation
When retry took place
The role assigned to this investigation
is it scheduled
The name of the system associated with this entry
Tags
TagsRaw
TaskID - used if the entry is assigned as note to a playbook task
EntryType specifies the type of the entry
The user who created the entry
POST /xsoar/public/v1/entry/note HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 105
{
"id": "cc7abfdb-a6e8-4a43-84f7-edf3cae42821@129739",
"version": 2,
"investigationId": "129739",
"data": "true"
}OK
{
"id": "ca462cc7-2969-497c-82fe-870ecee2183f@157448",
"version": 3,
"cacheVersn": 0,
"modified": "2024-02-21T13:06:24.205833123Z",
"sizeInBytes": 0,
"dbotCreatedBy": "user@company.com",
"type": 1,
"created": "2024-02-21T13:05:55.70602Z",
"incidentCreationTime": "2024-02-21T13:05:55.706020952Z",
"investigationCreationTime": "2024-02-21T09:41:41.293Z",
"retryTime": "0001-01-01T00:00:00Z",
"user": "user@company.com",
"errorSource": "",
"contents": "testing note",
"format": "markdown",
"investigationId": "157448",
"file": "",
"fileID": "",
"parentId": "",
"pinned": false,
"fileMetadata": null,
"parentContent": null,
"parentEntryTruncated": false,
"system": "",
"reputations": null,
"category": "chat",
"note": true,
"isTodo": false,
"tags": null,
"tagsRaw": null,
"startDate": "0001-01-01T00:00:00Z",
"times": 0,
"recurrent": false,
"endingDate": "0001-01-01T00:00:00Z",
"timezoneOffset": 0,
"cronView": false,
"scheduled": false,
"scheduledEntryGuid": "",
"entryTask": null,
"taskId": "",
"playbookId": "",
"reputationSize": 0,
"contentsSize": 12,
"brand": "none",
"InstanceID": "",
"IndicatorTimeline": null,
"Relationships": null,
"mirrored": false
}Set one or several tags on an incident War Room entry.
OK
Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined
The contents of the entry that is actually indexed - should not be used
ContentsSize the total size of the contents
Who has created this event - relevant only for manual incidents
EndingType holds the type of schedule Ending
Source of the error
Filename of associated content
FileID is the file name when saved in the server
Holds information on how content is formatted
Internal field to make queries on role faster
store the entry based on IncidentCreationTime
The id of the investigation it belongs to
IsTodo
Only used for outbound mirroring to mark that it is already mirrored to remote system
Note
ParentEntry content - for reference
ParentEntryTruncated - indicates weather entry content was truncated
ParentId is the ID of the parent entry
Mark entry as pinned = evidence
PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook
Only used for polling entries
Do not change this field manually
ReadOnly
ReputationSize the total size of the reputation
When retry took place
The role assigned to this investigation
is it scheduled
The name of the system associated with this entry
Tags
TagsRaw
TaskID - used if the entry is assigned as note to a playbook task
EntryType specifies the type of the entry
The user who created the entry
POST /xsoar/public/v1/entry/tags HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 125
{
"id": "4f73607e-be7f-448e-8a6a-18bd25633ea6@129741",
"version": 2,
"investigationId": "129741",
"tags": [
"tag_mBIUqRtI",
"tag_123"
]
}OK
{
"id": "5862e602-88c4-4a6b-8491-97acd655f25f@157448",
"version": 2,
"cacheVersn": 0,
"modified": "2024-02-21T13:02:48.100365928Z",
"sizeInBytes": 0,
"dbotCreatedBy": "ishestakov@paloaltonetworks.com",
"type": 1,
"created": "2024-02-21T13:02:08.628565Z",
"incidentCreationTime": "2024-02-21T13:02:08.628565804Z",
"investigationCreationTime": "2024-02-21T09:41:41.293Z",
"retryTime": "0001-01-01T00:00:00Z",
"user": "ishestakov@paloaltonetworks.com",
"errorSource": "",
"contents": "Testing war room tags",
"format": "markdown",
"investigationId": "157448",
"file": "",
"fileID": "",
"parentId": "",
"pinned": false,
"fileMetadata": null,
"parentContent": null,
"parentEntryTruncated": false,
"system": "",
"reputations": null,
"category": "chat",
"note": false,
"isTodo": false,
"tags": [
"tag_mBIUqRtI",
"tag_123"
],
"tagsRaw": [
"tag_mBIUqRtI",
"tag_123"
],
"startDate": "0001-01-01T00:00:00Z",
"times": 0,
"recurrent": false,
"endingDate": "0001-01-01T00:00:00Z",
"timezoneOffset": 0,
"cronView": false,
"scheduled": false,
"scheduledEntryGuid": "",
"entryTask": null,
"taskId": "",
"playbookId": "",
"reputationSize": 0,
"contentsSize": 21,
"brand": "none",
"InstanceID": "",
"IndicatorTimeline": null,
"Relationships": null,
"mirrored": false
}api_key
DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmrapi_key_id
2841OK
POST /xsoar/public/v1/entry/upload/{incident_id} HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: multipart/form-data
Accept: */*
Content-Length: 97
{
"file": "binary",
"fileComment": "text",
"isNoteEntry": "text",
"showMediaFiles": "text",
"tags": "text"
}OK
{
"cacheVersn": 0,
"category": "",
"childs": null,
"closed": "0001-01-01T00:00:00Z",
"created": "2024-06-24T10:30:40.976Z",
"creatingUserId": "user@company.com",
"dbotCreatedBy": "user@company.com",
"details": "",
"entries": [
{
"IndicatorTimeline": null,
"InstanceID": "",
"Relationships": null,
"brand": "none",
"cacheVersn": 0,
"category": "artifact",
"contents": "",
"contentsSize": 0,
"created": "2024-06-24T10:40:34.49701084Z",
"cronView": false,
"dbotCreatedBy": "user@company.com",
"endingDate": "0001-01-01T00:00:00Z",
"entryTask": null,
"errorSource": "",
"file": "1gnUV0aC.text",
"fileID": "fda567c4-bc89-4d7c-6ad2-08b0bb911f14",
"fileMetadata": {
"info": "ASCII text, with no line terminators",
"isMediaFile": false,
"md5": "fddbae73afdf86e3dc83a48f8c14d718",
"sha1": "b82a24c6b135c47c8652b58f9796bba4c7de76ab",
"sha256": "70b2f290b658a1e7283555e6f01cb3741463b40208c5d4459cfa76740b52e555",
"sha512": "cfba49672d091c16a3aa4c62b41cd2f6a8008e6bd9e0cf5980748c248ace8ec0c546c5d6603074561763afea1172d591a913a0b22f181b77e3997c4b12b5f9b5",
"size": 15,
"ssdeep": "3:NvREvnn:xy/",
"type": "text"
},
"format": "",
"id": "a6aa39b4-de85-49b0-8e64-0f5321ab6bbf@209003",
"incidentCreationTime": "2024-06-24T10:40:34.49701084Z",
"investigationCreationTime": "2024-06-24T10:30:40.976Z",
"investigationId": "209003",
"isTodo": false,
"mirrored": false,
"modified": "2024-06-24T10:40:35.072703082Z",
"note": false,
"parentContent": null,
"parentEntryTruncated": false,
"parentId": "",
"pinned": false,
"playbookId": "",
"recurrent": false,
"reputationSize": 0,
"reputations": null,
"retryTime": "0001-01-01T00:00:00Z",
"scheduled": false,
"scheduledEntryGuid": "",
"sizeInBytes": 0,
"startDate": "0001-01-01T00:00:00Z",
"system": "",
"tags": [],
"tagsRaw": [],
"taskId": "",
"times": 0,
"timezoneOffset": 0,
"type": 3,
"user": "",
"version": 2
}
],
"entryUsers": null,
"highPriority": false,
"id": "209003",
"invContext": null,
"isDebug": false,
"lastOpen": "0001-01-01T00:00:00Z",
"mirrorAutoClose": null,
"mirrorTypes": null,
"modified": "0001-01-01T00:00:00Z",
"name": "rocket_fkyPQPcS",
"rawCategory": "",
"reason": null,
"runStatus": "",
"sizeInBytes": 0,
"slackMirrorAutoClose": false,
"slackMirrorType": "",
"status": 0,
"systems": null,
"tags": null,
"totalEntries": 0,
"type": 0,
"users": [
"user@company.com"
],
"version": 1
}Create a new entry in an existing investigation in markdown format, and get the child entries in response
api_key
DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmrapi_key_id
2841OK - Returns an array of the child entries of the executed entry.
Entry holds a single entry in an investigation. Entries entered within a short amount of time by the same user are combined
The contents of the entry that is actually indexed - should not be used
ContentsSize the total size of the contents
Who has created this event - relevant only for manual incidents
EndingType holds the type of schedule Ending
Source of the error
Filename of associated content
FileID is the file name when saved in the server
Holds information on how content is formatted
Internal field to make queries on role faster
store the entry based on IncidentCreationTime
The id of the investigation it belongs to
IsTodo
Only used for outbound mirroring to mark that it is already mirrored to remote system
Note
ParentEntry content - for reference
ParentEntryTruncated - indicates weather entry content was truncated
ParentId is the ID of the parent entry
Mark entry as pinned = evidence
PlaybookID - if the entry is assigned as note to a playbook task, it will hold the playbook
Only used for polling entries
Do not change this field manually
ReadOnly
ReputationSize the total size of the reputation
When retry took place
The role assigned to this investigation
is it scheduled
The name of the system associated with this entry
Tags
TagsRaw
TaskID - used if the entry is assigned as note to a playbook task
EntryType specifies the type of the entry
The user who created the entry
Precondition Failed - The investigation is already closed.
POST /xsoar/public/v1/entry/execute/sync HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 59
{
"data": "!Print value=7ucpmYnx",
"investigationId": "243905"
}[
{
"id": "c6f851e9-ebdf-4a7b-884a-f957856f64c1@242906",
"version": 1,
"cacheVersn": 0,
"modified": "2024-08-15T12:50:44.693802365Z",
"sizeInBytes": 0,
"dbotCreatedBy": "user@company.com",
"type": 1,
"created": "2024-08-15T12:50:44.693779705Z",
"incidentCreationTime": "2024-08-15T12:50:44.693779705Z",
"investigationCreationTime": "2024-08-15T12:50:41.654Z",
"retryTime": "0001-01-01T00:00:00Z",
"user": "",
"errorSource": "",
"contents": "7ucpmYnx",
"format": "markdown",
"investigationId": "243905",
"file": "",
"fileID": "",
"parentId": "a61045c9-5770-44de-8d7f-ffacdf613763@243905",
"pinned": false,
"fileMetadata": null,
"parentContent": "!Print value=7ucpmYnx",
"parentEntryTruncated": false,
"system": "",
"reputations": null,
"category": "artifact",
"note": false,
"isTodo": false,
"tags": null,
"tagsRaw": null,
"startDate": "0001-01-01T00:00:00Z",
"times": 0,
"recurrent": false,
"endingDate": "0001-01-01T00:00:00Z",
"timezoneOffset": 0,
"cronView": false,
"scheduled": false,
"scheduledEntryGuid": "",
"entryTask": null,
"taskId": "",
"playbookId": "",
"reputationSize": 0,
"contentsSize": 15,
"brand": "Scripts",
"instance": "Scripts",
"InstanceID": "ScriptServicesModule",
"IndicatorTimeline": null,
"Relationships": null,
"mirrored": false
}
]Last updated
Was this helpful?