Incident Fields
APIs for managing incident fields
Define and create a new incident field.
Body
typestringOptional
namestringOptional
caseInsensitivebooleanOptional
slaintegerOptional
propagationLabelsstring[]Optional
unsearchablebooleanOptional
breachScriptstringOptional
requiredbooleanOptional
scriptnullOptional
Responses
200
OK
application/json
idstringOptional
versionintegerOptional
cacheVersnintegerOptional
modifiedstringOptional
sizeInBytesintegerOptional
dbotCreatedBystringOptional
accountstringOptional
autimeintegerOptional
typestringOptional
rawTypestringOptional
namestringOptional
rawNamestringOptional
statusintegerOptional
custom_statusstringOptional
resolution_statusstringOptional
reasonstringOptional
createdstringOptional
occurredstringOptional
closedstringOptional
slaintegerOptional
severityintegerOptional
investigationIdstringOptional
attachmentany · nullableOptional
detailsstringOptional
openDurationintegerOptional
lastOpenstringOptional
closingUserIdstringOptional
ownerstringOptional
activatedstringOptional
closeReasonstringOptional
rawCloseReasonstringOptional
closeNotesstringOptional
playbookIdstringOptional
dueDatestringOptional
reminderstringOptional
runStatusstringOptional
notifyTimestringOptional
phasestringOptional
rawPhasestringOptional
isPlaygroundbooleanOptional
rawJSONstringOptional
parentstringOptional
parentXDRIncidentstringOptional
retainedbooleanOptional
categorystringOptional
rawCategorystringOptional
linkedIncidentsany · nullableOptional
linkedCountintegerOptional
droppedCountintegerOptional
sourceInstancestringOptional
sourceBrandstringOptional
canvasesany · nullableOptional
lastJobRunTimestringOptional
feedBasedbooleanOptional
dbotMirrorIdstringOptional
dbotMirrorInstancestringOptional
dbotMirrorDirectionstringOptional
dbotDirtyFieldsany · nullableOptional
dbotCurrentDirtyFieldsany · nullableOptional
dbotMirrorTagsany · nullableOptional
dbotMirrorLastSyncstringOptional
isDebugbooleanOptional
changeStatusstringOptional
insightsintegerOptional
post/xsoar/public/v1/incidentfield
POST /xsoar/public/v1/incidentfield HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 167
{
"type": "shortText",
"name": "CsXOLGKo",
"caseInsensitive": true,
"sla": 0,
"propagationLabels": [
"all"
],
"unsearchable": false,
"breachScript": "",
"required": false,
"script": null
}200
OK
{
"id": "157447",
"version": 2,
"cacheVersn": 0,
"modified": "2024-02-21T12:58:29.813Z",
"sizeInBytes": 0,
"dbotCreatedBy": "user@company.com",
"CustomFields": {
"actionsoncampaignincidents": "Close",
"actionsonlowsimilarityincidents": "Add To Campaign",
"awsguarddutyconfidencescore": 0,
"bmcassignee": [
{}
],
"bmccustomer": [
{}
],
"bmcrequester": [
{}
],
"campaignemailsenderinstance": "rocket_gmail_instance_5p8iV9OZ",
"chronicleautoblockentities": "Yes",
"chronicleskipentityisolation": "Yes",
"cohesityheliosanomalystrength": 0,
"cohesityheliosclusterid": 0,
"containmentsla": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 30,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"crowdstrikefalconbehaviourpatterndispositiondetails": [
{},
{},
{}
],
"cryptosimcategoryid": 0,
"cryptosimcorrelationid": 0,
"cryptosimpluginid": 0,
"datadogcloudsiem": [],
"datadogcloudsiemcustomerimpacted": false,
"datadogcloudsiemdetectandcreateduration": 0,
"datadogcloudsiemrepairtime": 0,
"datadogcloudsiemuserisservice": false,
"datadogcloudsiemuserverified": false,
"dataminrpulserelatedterms": [
{},
{},
{}
],
"dbotpredictionprobability": 0,
"decyfirdatadetails": [
{},
{},
{}
],
"detectionsla": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 20,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"domaintoolsirisdetect": [
{},
{},
{}
],
"emaildeletefrombrand": "Unspecified",
"emaildeletetype": "soft",
"endpoint": [
{}
],
"externalid": "157447",
"extrahoprevealxdetectiondevices": [
{},
{},
{}
],
"extrahoprevealxmitretechniques": [
{},
{},
{}
],
"failedlogonevents": 0,
"filerelationships": [
{},
{},
{}
],
"fortisiemattacktactics": [
{},
{}
],
"fortisiemevents": [
{}
],
"grafanapanelid": 0,
"incidentduration": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 0,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"incidentrdpachehuntingstringssimilarity": [
{},
{},
{}
],
"incidentrdpcachehuntingstringsifter": [
{},
{},
{}
],
"inventasource": [
{}
],
"isactive": "true",
"isvpnipaddress": false,
"microsoftsentinelowner": [],
"numberoffoundrelatedalerts": 0,
"numberofrelatedincidents": 0,
"numberofsimilarfiles": 0,
"qintelqwatchexposures": [
{},
{},
{}
],
"remediationsla": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 7200,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"riskiqautoexcludewhitelistedipaddress": "Yes",
"riskiqautowhitelistipaddress": "Yes",
"rocketfield02mxekkb": "option_f1kSTDSS",
"rocketfield0qietilt": [
{}
],
"rocketfield0yxt8qks": 0,
"rocketfield1m1nknsl": "rocket_kUrYJCYH",
"rocketfield2f1ram7u": false,
"rocketfield3d4otr42": [
{}
],
"rocketfield3degpevt": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfield3rxb5har": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfield3uuagwwt": "rocket_jvrHjnA7",
"rocketfield42q8ri0w": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfield4ejubigq": 0,
"rocketfield4r4tiz6w": false,
"rocketfield6ipswid8": 0,
"rocketfield6mo51xzn": "rocket_2G5KQgOq",
"rocketfield7prumt0z": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfield82dosswp": 0,
"rocketfield8wnmyyvc": "rocket_30PKbAUW",
"rocketfield9cxc2wvd": 0,
"rocketfield9xa0o3nq": "WZ3sR6",
"rocketfielda28fg0oj": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfielda40b2sfg": 0,
"rocketfieldaax9wgte": [
{}
],
"rocketfieldaenrumcr": "Uo3MEg",
"rocketfieldbdvhqhgd": 0,
"rocketfieldbmhsqopn": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldbp7q7pbn": 0,
"rocketfieldbtde7csg": 0,
"rocketfieldbtndlwtx": 0,
"rocketfieldbxvy7aci": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldbzxrevrq": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldc04gzmja": 0,
"rocketfieldcfdrg1gv": 0,
"rocketfieldcfzmni5r": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldcjngz1hr": false,
"rocketfieldd9wodnig": false,
"rocketfielddiucwg95": 0,
"rocketfielddiwd4pdj": 0,
"rocketfielddpma6rxc": [
{}
],
"rocketfielddpydb2ts": "rocket_mCQCvo20",
"rocketfielde2kkcgrh": 0,
"rocketfieldeixka2g7": 0,
"rocketfieldeyincu1n": false,
"rocketfieldeyw5e4sm": 0,
"rocketfieldf0mrcm8q": [
{}
],
"rocketfieldf1zopnib": 0,
"rocketfieldfd8noctx": false,
"rocketfieldfvaoecwo": false,
"rocketfieldgcjnl61d": 0,
"rocketfieldgkraobgl": 0,
"rocketfieldh5kqjhzc": 0,
"rocketfieldhx9vm4pc": false,
"rocketfieldi3yadn4o": false,
"rocketfieldiuoszzbg": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldivotdorp": "rocket_LfKMcWj5",
"rocketfieldj8zkfsym": [
{}
],
"rocketfieldjbpbuedw": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldjiar3e0a": "rocket_12IRzenM",
"rocketfieldjj5vb0lk": 0,
"rocketfieldkethuvyk": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldkpgyu158": [
{}
],
"rocketfieldkun3mu2u": false,
"rocketfieldl9vibxon": 0,
"rocketfieldlyefflpk": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldmc5sbbxx": 0,
"rocketfieldmnuezx1q": "rocket_bU5TjVJf",
"rocketfieldmsxznc2y": 0,
"rocketfieldnlyjpp21": false,
"rocketfieldnqjoehxl": [
{}
],
"rocketfieldo1yxp4dy": [
{}
],
"rocketfieldo4zg2bva": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldobcuclor": 0,
"rocketfieldohqjmx5w": false,
"rocketfieldoizbgs9u": 0,
"rocketfieldoobhwdtf": 0,
"rocketfieldooiszo3v": false,
"rocketfieldoq4ib3rq": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldoupkddj1": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldoz7n7gdi": false,
"rocketfieldphyivfgh": "rocket_vvOoi235",
"rocketfieldpn5nx1qc": 0,
"rocketfieldppnjqnl3": 0,
"rocketfieldpqkofav0": 0,
"rocketfieldpsjrp4kv": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldptulavso": false,
"rocketfieldpufesh2i": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldpx6wjuum": "rocket_5ryg2EXl",
"rocketfieldqbd6s83a": false,
"rocketfieldqe6qneof": false,
"rocketfieldqkco0yde": [
{}
],
"rocketfieldqku2kt7j": "rocket_8lraojiF",
"rocketfieldqp0o4lmh": "rocket_BlnkYAhj",
"rocketfieldqub0kxf8": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldqyeq7xpv": "rocket_Sj6ZQfYt",
"rocketfieldrbxb2vfr": 0,
"rocketfieldrhbldnmx": 0,
"rocketfieldrqskwjv8": [
{}
],
"rocketfieldsbwfoqdv": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldsiqptqqu": 0,
"rocketfieldstsfbljv": "option_2lPBa2b4",
"rocketfieldt5u0tvi2": 0,
"rocketfieldtb9lekl5": 0,
"rocketfieldtbazi7yi": false,
"rocketfieldthprm0ui": false,
"rocketfieldthtty9nn": false,
"rocketfieldtzpheljw": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldua8dwttq": 0,
"rocketfieldudib0zul": "rocket_P0vSojZn",
"rocketfielduo7lgqj9": 0,
"rocketfieldurfk9syh": "OnushD",
"rocketfieldv2iglhei": "ATGQkF",
"rocketfieldvh1ydrmm": "option_PKIbNz9h",
"rocketfieldvi5jxbxt": 0,
"rocketfieldvsehzb8s": [
{}
],
"rocketfieldvx1mztgq": 0,
"rocketfieldwawulkzu": false,
"rocketfieldwl53df56": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldwnzdgwsa": 0,
"rocketfieldwxyx6ugg": 0,
"rocketfieldwyw5iw48": "rocket_0xYBncbK",
"rocketfieldxf0uuduk": 0,
"rocketfieldxkevyilp": 0,
"rocketfieldxrbpjhnc": [
{}
],
"rocketfieldxsd42019": 0,
"rocketfieldxtmm8ix9": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldxw7hsi6s": 0,
"rocketfieldxyqyxhpn": 0,
"rocketfieldyfutodrw": false,
"rocketfieldym2kvwjh": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 1,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"rocketfieldzfml4ce0": false,
"rocketfieldzgsjduqe": "rocket_lTsQkUAH",
"rsametasevents": [],
"rsarawlogslist": [],
"saassecuritycategory": "no_reason",
"saassecurityremediationtype": "Remove public sharing",
"saassecurityremoveinheritedsharing": false,
"saassecuritystate": "open",
"saassecuritystatus": "open-new",
"securitypolicymatch": [
{}
],
"selectaction": "Close",
"servicenowbusinessimpact": "1 - Critical",
"servicenowcategory": "Inquiry / Help",
"servicenowimpact": "1 - High",
"servicenownotify": "Send Email",
"servicenowpriority": "1 - Critical",
"servicenowseverity": "1 - High",
"servicenowsircategory": "Confidential personal identity data exposure",
"servicenowsirstate": "New",
"servicenowstate": "1 - New",
"servicenowurgency": "1 - High",
"similarincidentsdbot": [
{}
],
"solarwindsacknowledged": false,
"solarwindsactivealertid": 0,
"solarwindsalertid": 0,
"solarwindsalertobjectid": 0,
"solarwindsalertrelatednodeid": 0,
"solarwindseventengineid": 0,
"solarwindseventid": 0,
"solarwindseventnetobjectid": 0,
"solarwindsinstancesiteid": 0,
"spycloudcompassdevicedata": [
{},
{},
{}
],
"suspiciousexecutions": [
{},
{},
{}
],
"testivan": false,
"thehiveflag": false,
"timetoassignment": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 0,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"triagesla": {
"accumulatedPause": 0,
"breachTriggered": false,
"dueDate": "0001-01-01T00:00:00Z",
"endDate": "0001-01-01T00:00:00Z",
"lastPauseDate": "0001-01-01T00:00:00Z",
"runStatus": "idle",
"sla": 30,
"slaStatus": -1,
"startDate": "0001-01-01T00:00:00Z",
"totalDuration": 0
},
"urlsslverification": [],
"xdralertsearchresults": [
{},
{},
{}
],
"xdrinvestigationresults": [
{},
{},
{},
{
"columnheader1": ""
},
{},
{
"columnheader1": ""
},
{},
{}
],
"xdrstarred": false,
"xmcyberavgcomplexityscore": 0,
"xmcybersecurityscoretrend": 0,
"xpanseserviceclassifications": [
{},
{},
{}
],
"xpanseservicevalidation": [
{
"columnheader1": ""
},
{},
{}
]
},
"account": "",
"autime": 1708507732380000000,
"type": "default_rocket_type",
"rawType": "default_rocket_type",
"name": "abc",
"rawName": "abc",
"status": 1,
"custom_status": "",
"resolution_status": "",
"reason": "",
"created": "2024-02-21T09:28:52.38Z",
"occurred": "2024-02-21T09:28:52.380846958Z",
"closed": "0001-01-01T00:00:00Z",
"sla": 0,
"severity": 0,
"investigationId": "157447",
"labels": [
{
"value": "user@company.com",
"type": "Instance"
},
{
"value": "Manual",
"type": "Brand"
}
],
"attachment": null,
"details": "",
"openDuration": 11057,
"lastOpen": "2024-02-21T12:58:28.639333128Z",
"closingUserId": "",
"owner": "user@company.com",
"activated": "0001-01-01T00:00:00Z",
"closeReason": "",
"rawCloseReason": "",
"closeNotes": "close_note_oAZROKPJ",
"playbookId": "",
"dueDate": "0001-01-01T00:00:00Z",
"reminder": "0001-01-01T00:00:00Z",
"runStatus": "",
"notifyTime": "0001-01-01T00:00:00Z",
"phase": "",
"rawPhase": "",
"isPlayground": false,
"rawJSON": "",
"parent": "",
"parentXDRIncident": "",
"retained": false,
"category": "",
"rawCategory": "",
"linkedIncidents": null,
"linkedCount": 0,
"droppedCount": 0,
"sourceInstance": "user@company.com",
"sourceBrand": "Manual",
"canvases": null,
"lastJobRunTime": "0001-01-01T00:00:00Z",
"feedBased": false,
"dbotMirrorId": "",
"dbotMirrorInstance": "",
"dbotMirrorDirection": "",
"dbotDirtyFields": null,
"dbotCurrentDirtyFields": null,
"dbotMirrorTags": null,
"dbotMirrorLastSync": "0001-01-01T00:00:00Z",
"isDebug": false,
"changeStatus": "",
"insights": 0
}Retrieve details on all incident fields in the tenant.
Responses
200
OK
application/json
aliasTostringOptional
associatedToAllbooleanOptional
associatedTypesstring[]Optional
AssociatedTypes - list of incident (case) types IDs related to specific incident field
autoCompleteTagsstring[]Optional
breachScriptstringOptional
cacheVersninteger · int64Optional
caseInsensitivebooleanOptional
cliNamestringOptional
closeFormbooleanOptional
commitMessagestringOptional
contentbooleanOptional
createdstring · date-timeOptional
definitionIdstringOptional
descriptionstringOptional
editFormbooleanOptional
fieldCalcScriptstringOptional
groupnumber · doubleOptional
FieldGroup is the field group
hiddenbooleanOptional
idstringOptional
indexNamestringOptional
isReadOnlybooleanOptional
lockedbooleanOptional
mergeStrategystringOptional
FieldMergeStrategy strategy for merging of indicator fields
modifiedstring · date-timeOptional
namestringOptional
neverSetAsRequiredbooleanOptional
numericIdinteger · int64Optional
openEndedbooleanOptional
orgTypestringOptional
ownerOnlybooleanOptional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
placeholderstringOptional
prevNamestringOptional
primaryTerminteger · int64Optional
propagationLabelsstring[]Optional
remotebooleanOptional
requiredbooleanOptional
runScriptAfterUpdatebooleanOptional
scriptstringOptional
selectValuesstring[]Optional
sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeInBytesinteger · int64Optional
slainteger · int64Optional
sortValuesstring[]Optional
syncHashstringOptional
systembooleanOptional
systemAssociatedTypesstring[]Optional
templatestringOptional
thresholdnumber · doubleOptional
typestringOptional
unmappedbooleanOptional
unsearchablebooleanOptional
useAsKpibooleanOptional
validatedErrorstringOptional
validationRegexstringOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
x2_fieldsstringOptional
get/xsoar/public/v1/incidentfields
GET /xsoar/public/v1/incidentfields HTTP/1.1
Host: api-yourfqdn
Accept: */*
200
OK
[
{
"id": "evidence_aaa",
"version": 1,
"cacheVersn": 0,
"modified": "0001-01-01T00:00:00Z",
"sizeInBytes": 0,
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"propagationLabels": [
"all"
],
"definitionId": "evidence",
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "Field edited",
"shouldCommit": true,
"name": "aaa",
"prevName": "",
"ownerOnly": false,
"placeholder": "",
"template": "",
"description": "",
"cliName": "aaa",
"type": "shortText",
"orgType": "",
"closeForm": false,
"editForm": true,
"required": true,
"script": "",
"runScriptAfterUpdate": false,
"fieldCalcScript": "",
"neverSetAsRequired": false,
"isReadOnly": false,
"selectValues": null,
"autoCompleteTags": null,
"validationRegex": "",
"x2_fields": "",
"useAsKpi": false,
"locked": false,
"system": false,
"content": false,
"group": 1,
"mergeStrategy": "",
"hidden": false,
"openEnded": false,
"associatedTypes": null,
"systemAssociatedTypes": null,
"associatedToAll": true,
"unmapped": false,
"unsearchable": false,
"caseInsensitive": true,
"columns": null,
"defaultRows": null,
"sla": 0,
"threshold": 72,
"breachScript": "",
"validatedError": "",
"aliases": null,
"aliasTo": "",
"XDRBuiltInField": false,
"selectValuesMap": null,
"ipVersion": "",
"pretty_name": "aaa"
},
{
"id": "evidence_description",
"version": 0,
"cacheVersn": 0,
"modified": "2024-02-20T16:26:52.396273727Z",
"sizeInBytes": 0,
"packID": "",
"packName": "",
"itemVersion": "",
"fromServerVersion": "",
"toServerVersion": "",
"propagationLabels": [
"all"
],
"definitionId": "",
"vcShouldIgnore": false,
"vcShouldKeepItemLegacyProdMachine": false,
"commitMessage": "",
"shouldCommit": false,
"name": "description",
"prevName": "",
"ownerOnly": false,
"placeholder": "",
"template": "",
"description": "",
"cliName": "description",
"type": "longText",
"orgType": "",
"closeForm": false,
"editForm": true,
"required": true,
"script": "",
"runScriptAfterUpdate": false,
"fieldCalcScript": "",
"neverSetAsRequired": false,
"isReadOnly": false,
"selectValues": null,
"autoCompleteTags": null,
"validationRegex": "",
"x2_fields": "",
"useAsKpi": false,
"locked": false,
"system": true,
"content": false,
"group": 1,
"mergeStrategy": "",
"hidden": false,
"openEnded": false,
"associatedTypes": null,
"systemAssociatedTypes": null,
"associatedToAll": false,
"unmapped": false,
"unsearchable": false,
"caseInsensitive": false,
"columns": null,
"defaultRows": null,
"sla": 0,
"threshold": 0,
"breachScript": "",
"validatedError": "",
"aliases": null,
"aliasTo": "",
"XDRBuiltInField": false,
"selectValuesMap": null,
"ipVersion": "",
"pretty_name": "Description"
}
]Last updated
Was this helpful?