Skip to main content

updateIncidentNote

This method assigns a note to an incident.

Important

This method has been updated to version 1.1. For information applicable to version 1.0, refer to this section.

Parameters

Parameter

Type

Optional

Description

type

String

No

The type of the target incident. Possible values:

  • incidents - incidents generated as a result of a new Root Cause Analysis (RCA) being displayed under the Incidents section of GravityZone Control Center. You can find these incidents under the Endpoint Incidents or Detected Threats tabs.

  • extendedIncidents - These incidents can be found in the Incidents page in GravityZone Control Center, under the Extended Incidents tab.

incidentId

String

No

The ID of the incident, obtained from the Event Push details. The value corresponds to the incident_id parameter from New incident and New extended incident event types.

Tip

You can get the ID of a specific incident form the GravityZone console by following these steps:

  1. Log in to GravityZone.

  2. Go to the Incidents page and locate the incident you want to change the status for.

  3. Select the menu item on the right side of the table on the row of the target incident.

  4. Select View events and alerts.

    A new browser window is open with the details of the incident. The incident ID is included in the URL of the page.

    Example

    https://cloudgz.gravityzone.bitdefender.com/#!/xdr/events/65dc39197a4a51fb2b7f15ee

note

String

No

The text to be included in the note.

Note

If the incident already has a note assigned to it, it will be overwritten.

Return value

This method returns a Boolean which is True if the note is assigned successfully.

Examples

Request:

{
    "params": {
      "incidentId" : "621342db44747b408b7edf65",
      "type" : "extendedIncidents" or "incidents",
      "note" : "A random note"
    },
    "jsonrpc": "2.0",
    "method": "updateIncidentNote",
    "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810"
}

Response:

{
    "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810",
    "jsonrpc": "2.0",
    "result": true
}

Version 1.0

Parameters

Parameter

Type

Optional

Description

type

String

No

The type of the target incident. Possible values:

  • incidents - incidents generated as a result of a new Root Cause Analysis (RCA) being displayed under the Incidents section of GravityZone Control Center. You can find these incidents under the Endpoint Incidents or Detected Threats tabs.

  • extendedIncidents - These incidents can be found in the Incidents page in GravityZone Control Center, under the Extended Incidents tab.

incidentId

String

No

The ID of the incident, obtained from the Event Push details. The value corresponds to the incident_id parameter from New Incident event types.

note

String

No

The text to be included in the note.

Note

If the incident already has a note assigned to it, it will be overwritten.

Return value

This method returns a Boolean which is True if the note is assigned successfully and the following object:

  • data, an object containing information related to the incident.

    • lastUpdated - the timestamp for the moment the note is changed.

Examples

Request:

{
    "params": {
      "incidentId" : "621342db44747b408b7edf65",
      "type" : "extendedIncidents" or "incidents",
      "note" : "A random note"
    },
    "jsonrpc": "2.0",
    "method": "updateIncidentNote",
    "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810"
}

Response:

{
    "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810",
    "jsonrpc": "2.0",
    "result": {
        "success": true
    }
}
In this section: