Skip to main content

updateIncidentNote

This method assigns a note to an incident.

Important

This method has been updated to version 1.1. For information applicable to version 1.0, refer to this section.

Parameters

Parameter

Type

Optional

Description

type

String

No

The type of the target incident. Possible values:

  • incidents - incidents generated as a result of a new Root Cause Analysis (RCA) being displayed under the Incidents section of GravityZone Control Center. You can find these incidents under the Endpoint Incidents or Detected Threats tabs.

  • extendedIncidents - These incidents can be found in the Incidents page in GravityZone Control Center, under the Extended Incidents tab.

incidentId

String

No

The ID of the incident, obtained from the Event Push details. The value corresponds to the incident_id parameter from New Incident event types.

note

String

No

The text to be included in the note.

Note

If the incident already has a note assigned to it, it will be overwritten.

Return value

This method returns a Boolean which is True if the note is assigned successfully.

Examples

Request:

{
    "params": {
      "incidentId" : "621342db44747b408b7edf65",
      "type" : "extendedIncidents" or "incidents",
      "note" : "A random note"
    },
    "jsonrpc": "2.0",
    "method": "updateIncidentNote",
    "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810"
}

Response:

{
    "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810",
    "jsonrpc": "2.0",
    "result": true
}

Version 1.0

Parameters

Parameter

Type

Optional

Description

type

String

No

The type of the target incident. Possible values:

  • incidents - incidents generated as a result of a new Root Cause Analysis (RCA) being displayed under the Incidents section of GravityZone Control Center. You can find these incidents under the Endpoint Incidents or Detected Threats tabs.

  • extendedIncidents - These incidents can be found in the Incidents page in GravityZone Control Center, under the Extended Incidents tab.

incidentId

String

No

The ID of the incident, obtained from the Event Push details. The value corresponds to the incident_id parameter from New Incident event types.

note

String

No

The text to be included in the note.

Note

If the incident already has a note assigned to it, it will be overwritten.

Return value

This method returns a Boolean which is True if the note is assigned successfully and the following object:

  • data, an object containing information related to the incident.

    • lastUpdated - the timestamp for the moment the note is changed.

Examples

Request:

{
    "params": {
      "incidentId" : "621342db44747b408b7edf65",
      "type" : "extendedIncidents" or "incidents",
      "note" : "A random note"
    },
    "jsonrpc": "2.0",
    "method": "updateIncidentNote",
    "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810"
}

Response:

{
    "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810",
    "jsonrpc": "2.0",
    "result": {
        "success": true
    }
}
In this section: