Resilient

Publisher: Splunk Community
Connector Version: 1.1.0
Product Vendor: Resilient
Product Name: IBM Resilient
Product Version Supported (regex): ".*"
Minimum Product Version: 5.2.0

Resilient Ticket System

Port Information

The app uses HTTP/ HTTPS protocol for communicating with the Exabeam server. Below are the default ports used by Splunk SOAR.

Service Name	Transport Protocol	Port
http	tcp	80
https	tcp	443

Configuration Variables

The below configuration variables are required for this Connector to operate. These variables are specified when configuring a IBM Resilient asset in SOAR.

VARIABLE	REQUIRED	TYPE	DESCRIPTION
base_url	required	string	Base URL
org_id	required	string	Organization Name
user	required	string	Service Account
password	required	password	Service Account Password
verify	optional	boolean	Verify SSL certificates. You may need to set REQUESTS_CA_BUNDLE to the pem file containing your local CA root certificates

Supported Actions

test connectivity - Test connectivity
list tickets - List all incidents
get ticket - Get incident details by id
create ticket - Create new incident
update ticket - Update existing incident. This action downloads the incident and copies the provided JSON onto the download data, overwriting any existing data elements
search tickets - Submit search query for incidents
list artifacts - List all artifacts for incident
get artifact - Get artifact details by incident and artifact id
create artifact - Create new artifact
update artifact - Update existing artifact
list comments - List all comment for incident
get comment - Get comment details by incident and comment id
create comment - Create new comment
update comment - Update existing comment
list tables - List tables
get table - Get table
add table row - Add table row
update table row - Update table row
update table row with key - Update table row with key
list tasks - List tasks for user (defined in asset configuration)
get task - Get task details
update task - Update task. This action downloads the task and copy the provided json onto the download data, overwriting any existing data elements
close task - Close task
list attachments - List attachments for incident
get attachment - Get attachment details from incident
add attachment - Add attachment to incident

action: 'test connectivity'

Test connectivity

Type: investigate
Read only: True

Action Parameters

No parameters are required for this action

Action Output

DATA PATH	TYPE	CONTAINS
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'list tickets'

List all incidents

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
want_closed	optional	Also returns closed incidents. Default is true	boolean

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.want_closed	boolean
action_result.data.*.addr	string
action_result.data.*.admin_id	string
action_result.data.*.assessment	string
action_result.data.*.city	string
action_result.data.*.confirmed	boolean
action_result.data.*.country	string
action_result.data.*.create_date	numeric
action_result.data.*.creator.cell	string
action_result.data.*.creator.create_date	numeric
action_result.data.*.creator.display_name	string
action_result.data.*.creator.email	string	email
action_result.data.*.creator.fname	string
action_result.data.*.creator.id	numeric
action_result.data.*.creator.is_external	boolean
action_result.data.*.creator.last_login	numeric
action_result.data.*.creator.last_modified_time	numeric
action_result.data.*.creator.lname	string
action_result.data.*.creator.locked	boolean
action_result.data.*.creator.password_changed	boolean
action_result.data.*.creator.phone	string
action_result.data.*.creator.status	string
action_result.data.*.creator_id	numeric
action_result.data.*.creator_principal.display_name	string
action_result.data.*.creator_principal.id	numeric
action_result.data.*.creator_principal.name	string	email
action_result.data.*.creator_principal.type	string
action_result.data.*.crimestatus_id	numeric
action_result.data.*.data_compromised	string
action_result.data.*.description	string
action_result.data.*.discovered_date	numeric
action_result.data.*.draft	boolean
action_result.data.*.due_date	string
action_result.data.*.employee_involved	string
action_result.data.*.end_date	string
action_result.data.*.exposure	numeric
action_result.data.*.exposure_dept_id	string
action_result.data.*.exposure_individual_name	string
action_result.data.*.exposure_type_id	numeric
action_result.data.*.exposure_vendor_id	string
action_result.data.*.gdpr.gdpr_breach_type	string
action_result.data.*.gdpr.gdpr_breach_type_comment	string
action_result.data.*.gdpr.gdpr_consequences	string
action_result.data.*.gdpr.gdpr_consequences_comment	string
action_result.data.*.gdpr.gdpr_final_assessment	string
action_result.data.*.gdpr.gdpr_final_assessment_comment	string
action_result.data.*.gdpr.gdpr_identification	string
action_result.data.*.gdpr.gdpr_identification_comment	string
action_result.data.*.gdpr.gdpr_personal_data	string
action_result.data.*.gdpr.gdpr_personal_data_comment	string
action_result.data.*.gdpr.gdpr_subsequent_notification	string
action_result.data.*.hard_liability	numeric
action_result.data.*.id	numeric	ibm resilient ticketid
action_result.data.*.inc_last_modified_date	numeric
action_result.data.*.inc_start	string
action_result.data.*.inc_training	boolean
action_result.data.*.incident_type_ids	numeric
action_result.data.*.is_scenario	boolean
action_result.data.*.jurisdiction_name	string
action_result.data.*.jurisdiction_reg_id	string
action_result.data.*.name	string
action_result.data.*.negative_pr_likely	string
action_result.data.*.nist_attack_vectors	numeric
action_result.data.*.org_handle	numeric
action_result.data.*.org_id	numeric
action_result.data.*.owner_id	numeric
action_result.data.*.perms.assign	boolean
action_result.data.*.perms.attach_file	boolean
action_result.data.*.perms.change_members	boolean
action_result.data.*.perms.change_workspace	boolean
action_result.data.*.perms.close	boolean
action_result.data.*.perms.comment	boolean
action_result.data.*.perms.create_artifacts	boolean
action_result.data.*.perms.create_milestones	boolean
action_result.data.*.perms.delete	boolean
action_result.data.*.perms.delete_attachments	boolean
action_result.data.*.perms.list_artifacts	boolean
action_result.data.*.perms.list_milestones	boolean
action_result.data.*.perms.read	boolean
action_result.data.*.perms.read_attachments	boolean
action_result.data.*.perms.write	boolean
action_result.data.*.phase_id	numeric
action_result.data.*.pii.alberta_health_risk_assessment	string
action_result.data.*.pii.assessment	string
action_result.data.*.pii.data_compromised	string
action_result.data.*.pii.data_contained	string
action_result.data.*.pii.data_encrypted	string
action_result.data.*.pii.data_format	string
action_result.data.*.pii.determined_date	numeric
action_result.data.*.pii.exposure	numeric
action_result.data.*.pii.gdpr_harm_risk	string
action_result.data.*.pii.harmstatus_id	numeric
action_result.data.*.pii.impact_likely	string
action_result.data.*.pii.ny_impact_likely	string
action_result.data.*.plan_status	string
action_result.data.*.reporter	string
action_result.data.*.resolution_id	string
action_result.data.*.resolution_summary	string
action_result.data.*.severity_code	string
action_result.data.*.start_date	string
action_result.data.*.state	string
action_result.data.*.vers	numeric
action_result.data.*.workspace	numeric
action_result.data.*.zip	string
action_result.summary.Number of incidents	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get ticket'

Get incident details by id

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
incident_id	required	ID of incident to retrieve	string	ibm resilient ticketid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.incident_id	string
action_result.data.*.addr	string
action_result.data.*.admin_id	string
action_result.data.*.artifacts	string
action_result.data.*.assessment	string
action_result.data.*.city	string
action_result.data.*.cm.total	numeric
action_result.data.*.comments	string
action_result.data.*.confirmed	boolean
action_result.data.*.country	string
action_result.data.*.create_date	numeric
action_result.data.*.creator.cell	string
action_result.data.*.creator.create_date	numeric
action_result.data.*.creator.display_name	string
action_result.data.*.creator.email	string	email
action_result.data.*.creator.fname	string
action_result.data.*.creator.id	numeric
action_result.data.*.creator.is_external	boolean
action_result.data.*.creator.last_login	numeric
action_result.data.*.creator.last_modified_time	numeric
action_result.data.*.creator.lname	string
action_result.data.*.creator.locked	boolean
action_result.data.*.creator.password_changed	boolean
action_result.data.*.creator.phone	string
action_result.data.*.creator.status	string
action_result.data.*.creator_id	numeric
action_result.data.*.creator_principal.display_name	string
action_result.data.*.creator_principal.id	numeric
action_result.data.*.creator_principal.name	string	email
action_result.data.*.creator_principal.type	string
action_result.data.*.crimestatus_id	numeric
action_result.data.*.data_compromised	string
action_result.data.*.description	string
action_result.data.*.discovered_date	numeric
action_result.data.*.draft	boolean
action_result.data.*.due_date	string
action_result.data.*.employee_involved	string
action_result.data.*.end_date	string
action_result.data.*.exposure	numeric
action_result.data.*.exposure_dept_id	string
action_result.data.*.exposure_individual_name	string
action_result.data.*.exposure_type_id	numeric
action_result.data.*.exposure_vendor_id	string
action_result.data.*.gdpr.gdpr_breach_type	string
action_result.data.*.gdpr.gdpr_breach_type_comment	string
action_result.data.*.gdpr.gdpr_consequences	string
action_result.data.*.gdpr.gdpr_consequences_comment	string
action_result.data.*.gdpr.gdpr_final_assessment	string
action_result.data.*.gdpr.gdpr_final_assessment_comment	string
action_result.data.*.gdpr.gdpr_identification	string
action_result.data.*.gdpr.gdpr_identification_comment	string
action_result.data.*.gdpr.gdpr_personal_data	string
action_result.data.*.gdpr.gdpr_personal_data_comment	string
action_result.data.*.gdpr.gdpr_subsequent_notification	string
action_result.data.*.hard_liability	numeric
action_result.data.*.hipaa.hipaa_acquired	string
action_result.data.*.hipaa.hipaa_acquired_comment	string
action_result.data.*.hipaa.hipaa_additional_misuse	string
action_result.data.*.hipaa.hipaa_additional_misuse_comment	string
action_result.data.*.hipaa.hipaa_adverse	string
action_result.data.*.hipaa.hipaa_adverse_comment	string
action_result.data.*.hipaa.hipaa_breach	string
action_result.data.*.hipaa.hipaa_breach_comment	string
action_result.data.*.hipaa.hipaa_misused	string
action_result.data.*.hipaa.hipaa_misused_comment	string
action_result.data.*.id	numeric	ibm resilient ticketid
action_result.data.*.inc_last_modified_date	numeric
action_result.data.*.inc_start	string
action_result.data.*.inc_training	boolean
action_result.data.*.is_scenario	boolean
action_result.data.*.jurisdiction_name	string
action_result.data.*.jurisdiction_reg_id	string
action_result.data.*.name	string
action_result.data.*.negative_pr_likely	string
action_result.data.*.org_handle	numeric
action_result.data.*.org_id	numeric
action_result.data.*.owner_id	numeric
action_result.data.*.perms.assign	boolean
action_result.data.*.perms.attach_file	boolean
action_result.data.*.perms.change_members	boolean
action_result.data.*.perms.change_workspace	boolean
action_result.data.*.perms.close	boolean
action_result.data.*.perms.comment	boolean
action_result.data.*.perms.create_artifacts	boolean
action_result.data.*.perms.create_milestones	boolean
action_result.data.*.perms.delete	boolean
action_result.data.*.perms.delete_attachments	boolean
action_result.data.*.perms.list_artifacts	boolean
action_result.data.*.perms.list_milestones	boolean
action_result.data.*.perms.read	boolean
action_result.data.*.perms.read_attachments	boolean
action_result.data.*.perms.write	boolean
action_result.data.*.phase_id	numeric
action_result.data.*.pii.alberta_health_risk_assessment	string
action_result.data.*.pii.assessment	string
action_result.data.*.pii.data_compromised	string
action_result.data.*.pii.data_contained	string
action_result.data.*.pii.data_encrypted	string
action_result.data.*.pii.data_format	string
action_result.data.*.pii.determined_date	numeric
action_result.data.*.pii.exposure	numeric
action_result.data.*.pii.gdpr_harm_risk	string
action_result.data.*.pii.harmstatus_id	numeric
action_result.data.*.pii.impact_likely	string
action_result.data.*.pii.ny_impact_likely	string
action_result.data.*.plan_status	string
action_result.data.*.reporter	string
action_result.data.*.resolution_id	string
action_result.data.*.resolution_summary	string
action_result.data.*.severity_code	string
action_result.data.*.start_date	string
action_result.data.*.state	string
action_result.data.*.tasks	string
action_result.data.*.vers	numeric
action_result.data.*.workspace	numeric
action_result.data.*.zip	string
action_result.summary.Number of incidents	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'create ticket'

Create new incident

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
incident_name	required	Name of incident	string
incident_description	required	Short description of incident	string
fullincidentdatadto	optional	Incident data as JSON String, format is FullIncidentDataDTO data type from API	string
want_full_data	optional	Returns full incident instead of summary. Default is true	boolean
want_tasks	optional	Also returns associated tasks. Default is false	boolean

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.fullincidentdatadto	string
action_result.parameter.incident_description	string
action_result.parameter.incident_name	string
action_result.parameter.want_full_data	boolean
action_result.parameter.want_tasks	boolean
action_result.data.*.addr	string
action_result.data.*.admin_id	string
action_result.data.*.artifacts	string
action_result.data.*.assessment	string
action_result.data.*.city	string
action_result.data.*.cm.total	numeric
action_result.data.*.comments	string
action_result.data.*.confirmed	boolean
action_result.data.*.country	string
action_result.data.*.create_date	numeric
action_result.data.*.creator.cell	string
action_result.data.*.creator.create_date	numeric
action_result.data.*.creator.display_name	string
action_result.data.*.creator.email	string	email
action_result.data.*.creator.fname	string
action_result.data.*.creator.id	numeric
action_result.data.*.creator.is_external	boolean
action_result.data.*.creator.last_login	numeric
action_result.data.*.creator.last_modified_time	numeric
action_result.data.*.creator.lname	string
action_result.data.*.creator.locked	boolean
action_result.data.*.creator.password_changed	boolean
action_result.data.*.creator.phone	string
action_result.data.*.creator.status	string
action_result.data.*.creator_id	numeric
action_result.data.*.creator_principal.display_name	string
action_result.data.*.creator_principal.id	numeric
action_result.data.*.creator_principal.name	string	email
action_result.data.*.creator_principal.type	string
action_result.data.*.crimestatus_id	numeric
action_result.data.*.data_compromised	string
action_result.data.*.description	string
action_result.data.*.discovered_date	numeric
action_result.data.*.draft	boolean
action_result.data.*.due_date	string
action_result.data.*.employee_involved	string
action_result.data.*.end_date	string
action_result.data.*.exposure	numeric
action_result.data.*.exposure_dept_id	string
action_result.data.*.exposure_individual_name	string
action_result.data.*.exposure_type_id	numeric
action_result.data.*.exposure_vendor_id	string
action_result.data.*.gdpr.gdpr_breach_type	string
action_result.data.*.gdpr.gdpr_breach_type_comment	string
action_result.data.*.gdpr.gdpr_consequences	string
action_result.data.*.gdpr.gdpr_consequences_comment	string
action_result.data.*.gdpr.gdpr_final_assessment	string
action_result.data.*.gdpr.gdpr_final_assessment_comment	string
action_result.data.*.gdpr.gdpr_identification	string
action_result.data.*.gdpr.gdpr_identification_comment	string
action_result.data.*.gdpr.gdpr_personal_data	string
action_result.data.*.gdpr.gdpr_personal_data_comment	string
action_result.data.*.gdpr.gdpr_subsequent_notification	string
action_result.data.*.hard_liability	numeric
action_result.data.*.hipaa.hipaa_acquired	string
action_result.data.*.hipaa.hipaa_acquired_comment	string
action_result.data.*.hipaa.hipaa_additional_misuse	string
action_result.data.*.hipaa.hipaa_additional_misuse_comment	string
action_result.data.*.hipaa.hipaa_adverse	string
action_result.data.*.hipaa.hipaa_adverse_comment	string
action_result.data.*.hipaa.hipaa_breach	string
action_result.data.*.hipaa.hipaa_breach_comment	string
action_result.data.*.hipaa.hipaa_misused	string
action_result.data.*.hipaa.hipaa_misused_comment	string
action_result.data.*.id	numeric	ibm resilient ticketid
action_result.data.*.inc_last_modified_date	string
action_result.data.*.inc_start	string
action_result.data.*.inc_training	boolean
action_result.data.*.is_scenario	boolean
action_result.data.*.jurisdiction_name	string
action_result.data.*.jurisdiction_reg_id	string
action_result.data.*.name	string
action_result.data.*.negative_pr_likely	string
action_result.data.*.org_handle	numeric
action_result.data.*.org_id	numeric
action_result.data.*.owner_id	numeric
action_result.data.*.perms.assign	boolean
action_result.data.*.perms.attach_file	boolean
action_result.data.*.perms.change_members	boolean
action_result.data.*.perms.change_workspace	boolean
action_result.data.*.perms.close	boolean
action_result.data.*.perms.comment	boolean
action_result.data.*.perms.create_artifacts	boolean
action_result.data.*.perms.create_milestones	boolean
action_result.data.*.perms.delete	boolean
action_result.data.*.perms.delete_attachments	boolean
action_result.data.*.perms.list_artifacts	boolean
action_result.data.*.perms.list_milestones	boolean
action_result.data.*.perms.read	boolean
action_result.data.*.perms.read_attachments	boolean
action_result.data.*.perms.write	boolean
action_result.data.*.phase_id	numeric
action_result.data.*.pii.alberta_health_risk_assessment	string
action_result.data.*.pii.assessment	string
action_result.data.*.pii.data_compromised	string
action_result.data.*.pii.data_contained	string
action_result.data.*.pii.data_encrypted	string
action_result.data.*.pii.data_format	string
action_result.data.*.pii.determined_date	numeric
action_result.data.*.pii.exposure	numeric
action_result.data.*.pii.gdpr_harm_risk	string
action_result.data.*.pii.harmstatus_id	numeric
action_result.data.*.pii.impact_likely	string
action_result.data.*.pii.ny_impact_likely	string
action_result.data.*.plan_status	string
action_result.data.*.reporter	string
action_result.data.*.resolution_id	string
action_result.data.*.resolution_summary	string
action_result.data.*.severity_code	string
action_result.data.*.start_date	string
action_result.data.*.state	string
action_result.data.*.tasks.*.active	boolean
action_result.data.*.tasks.*.at_id	string
action_result.data.*.tasks.*.attachments_count	string
action_result.data.*.tasks.*.auto_deactivate	boolean
action_result.data.*.tasks.*.cat_name	string
action_result.data.*.tasks.*.category_id	numeric
action_result.data.*.tasks.*.closed_date	string
action_result.data.*.tasks.*.creator_principal.display_name	string
action_result.data.*.tasks.*.creator_principal.id	numeric
action_result.data.*.tasks.*.creator_principal.name	string	email
action_result.data.*.tasks.*.creator_principal.type	string
action_result.data.*.tasks.*.custom	boolean
action_result.data.*.tasks.*.description	string
action_result.data.*.tasks.*.due_date	string
action_result.data.*.tasks.*.form	string
action_result.data.*.tasks.*.frozen	boolean
action_result.data.*.tasks.*.id	numeric
action_result.data.*.tasks.*.inc_id	numeric
action_result.data.*.tasks.*.inc_name	string
action_result.data.*.tasks.*.inc_owner_id	numeric
action_result.data.*.tasks.*.inc_training	boolean
action_result.data.*.tasks.*.init_date	numeric
action_result.data.*.tasks.*.instr_text	string
action_result.data.*.tasks.*.instructions	string
action_result.data.*.tasks.*.members	string
action_result.data.*.tasks.*.name	string
action_result.data.*.tasks.*.notes_count	string
action_result.data.*.tasks.*.owner_fname	string
action_result.data.*.tasks.*.owner_id	string
action_result.data.*.tasks.*.owner_lname	string
action_result.data.*.tasks.*.perms.assign	boolean
action_result.data.*.tasks.*.perms.attach_file	boolean
action_result.data.*.tasks.*.perms.change_members	boolean
action_result.data.*.tasks.*.perms.close	boolean
action_result.data.*.tasks.*.perms.comment	boolean
action_result.data.*.tasks.*.perms.delete_attachments	boolean
action_result.data.*.tasks.*.perms.read	boolean
action_result.data.*.tasks.*.perms.read_attachments	boolean
action_result.data.*.tasks.*.perms.write	boolean
action_result.data.*.tasks.*.phase_id	numeric
action_result.data.*.tasks.*.private	string
action_result.data.*.tasks.*.regs.88	string
action_result.data.*.tasks.*.required	boolean
action_result.data.*.tasks.*.src_name	string
action_result.data.*.tasks.*.status	string
action_result.data.*.tasks.*.task_layout	string
action_result.data.*.tasks.*.user_notes	string
action_result.data.*.vers	numeric
action_result.data.*.workspace	numeric
action_result.data.*.zip	string
action_result.summary.Number of incidents	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'update ticket'

Update existing incident. This action downloads the incident and copies the provided JSON onto the download data, overwriting any existing data elements

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
incident_id	required	ID of incident to update	string	ibm resilient ticketid
fullincidentdatadto	required	Incident data as JSON String, the format is FullIncidentDataDTO data type from API. This data should first be retrieved from Resilient and then modified with the desired changes	string

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.fullincidentdatadto	string
action_result.parameter.incident_id	string
action_result.data.*.addr	string
action_result.data.*.admin_id	string
action_result.data.*.artifacts	string
action_result.data.*.assessment	string
action_result.data.*.city	string
action_result.data.*.cm.total	numeric
action_result.data.*.comments	string
action_result.data.*.confirmed	boolean
action_result.data.*.country	string
action_result.data.*.create_date	numeric
action_result.data.*.creator.cell	string
action_result.data.*.creator.create_date	numeric
action_result.data.*.creator.display_name	string
action_result.data.*.creator.email	string	email
action_result.data.*.creator.fname	string
action_result.data.*.creator.id	numeric
action_result.data.*.creator.is_external	boolean
action_result.data.*.creator.last_login	numeric
action_result.data.*.creator.last_modified_time	numeric
action_result.data.*.creator.lname	string
action_result.data.*.creator.locked	boolean
action_result.data.*.creator.password_changed	boolean
action_result.data.*.creator.phone	string
action_result.data.*.creator.status	string
action_result.data.*.creator_id	numeric
action_result.data.*.creator_principal.display_name	string
action_result.data.*.creator_principal.id	numeric
action_result.data.*.creator_principal.name	string	email
action_result.data.*.creator_principal.type	string
action_result.data.*.crimestatus_id	numeric
action_result.data.*.data_compromised	string
action_result.data.*.description	string
action_result.data.*.discovered_date	numeric
action_result.data.*.draft	boolean
action_result.data.*.due_date	string
action_result.data.*.employee_involved	string
action_result.data.*.end_date	string
action_result.data.*.exposure	numeric
action_result.data.*.exposure_dept_id	string
action_result.data.*.exposure_individual_name	string
action_result.data.*.exposure_type_id	numeric
action_result.data.*.exposure_vendor_id	string
action_result.data.*.gdpr.gdpr_breach_type	string
action_result.data.*.gdpr.gdpr_breach_type_comment	string
action_result.data.*.gdpr.gdpr_consequences	string
action_result.data.*.gdpr.gdpr_consequences_comment	string
action_result.data.*.gdpr.gdpr_final_assessment	string
action_result.data.*.gdpr.gdpr_final_assessment_comment	string
action_result.data.*.gdpr.gdpr_identification	string
action_result.data.*.gdpr.gdpr_identification_comment	string
action_result.data.*.gdpr.gdpr_personal_data	string
action_result.data.*.gdpr.gdpr_personal_data_comment	string
action_result.data.*.gdpr.gdpr_subsequent_notification	string
action_result.data.*.hard_liability	numeric
action_result.data.*.hipaa.hipaa_acquired	string
action_result.data.*.hipaa.hipaa_acquired_comment	string
action_result.data.*.hipaa.hipaa_additional_misuse	string
action_result.data.*.hipaa.hipaa_additional_misuse_comment	string
action_result.data.*.hipaa.hipaa_adverse	string
action_result.data.*.hipaa.hipaa_adverse_comment	string
action_result.data.*.hipaa.hipaa_breach	string
action_result.data.*.hipaa.hipaa_breach_comment	string
action_result.data.*.hipaa.hipaa_misused	string
action_result.data.*.hipaa.hipaa_misused_comment	string
action_result.data.*.id	numeric	ibm resilient ticketid
action_result.data.*.inc_last_modified_date	numeric
action_result.data.*.inc_start	string
action_result.data.*.inc_training	boolean
action_result.data.*.is_scenario	boolean
action_result.data.*.jurisdiction_name	string
action_result.data.*.jurisdiction_reg_id	string
action_result.data.*.name	string
action_result.data.*.negative_pr_likely	string
action_result.data.*.org_handle	numeric
action_result.data.*.org_id	numeric
action_result.data.*.owner_id	numeric
action_result.data.*.perms.assign	boolean
action_result.data.*.perms.attach_file	boolean
action_result.data.*.perms.change_members	boolean
action_result.data.*.perms.change_workspace	boolean
action_result.data.*.perms.close	boolean
action_result.data.*.perms.comment	boolean
action_result.data.*.perms.create_artifacts	boolean
action_result.data.*.perms.create_milestones	boolean
action_result.data.*.perms.delete	boolean
action_result.data.*.perms.delete_attachments	boolean
action_result.data.*.perms.list_artifacts	boolean
action_result.data.*.perms.list_milestones	boolean
action_result.data.*.perms.read	boolean
action_result.data.*.perms.read_attachments	boolean
action_result.data.*.perms.write	boolean
action_result.data.*.phase_id	numeric
action_result.data.*.pii.alberta_health_risk_assessment	string
action_result.data.*.pii.assessment	string
action_result.data.*.pii.data_compromised	string
action_result.data.*.pii.data_contained	string
action_result.data.*.pii.data_encrypted	string
action_result.data.*.pii.data_format	string
action_result.data.*.pii.determined_date	numeric
action_result.data.*.pii.exposure	numeric
action_result.data.*.pii.gdpr_harm_risk	string
action_result.data.*.pii.harmstatus_id	numeric
action_result.data.*.pii.impact_likely	string
action_result.data.*.pii.ny_impact_likely	string
action_result.data.*.plan_status	string
action_result.data.*.reporter	string
action_result.data.*.resolution_id	string
action_result.data.*.resolution_summary	string
action_result.data.*.severity_code	string
action_result.data.*.start_date	string
action_result.data.*.state	string
action_result.data.*.tasks	string
action_result.data.*.vers	numeric
action_result.data.*.workspace	numeric
action_result.data.*.zip	string
action_result.summary.Number of incidents	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'search tickets'

Submit search query for incidents

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
querydto	optional	Query data as JSON String, the format is QueryDTO data type from API	string
add_condition_all_active_tickets	optional	Filters for active tickets	boolean
add_condition_closed_in_last_24_hours	optional	Filters for tickets closed in last 24 hours	boolean
add_condition_created_in_last_24_hours	optional	Filters for tickets created in last 24 hours	boolean
1st_condition_field_name	optional	The field name in the condition	string
1st_condition_field_value	optional	The value used for comparison	string
1st_condition_value_is_datetime	optional	The value is a datetime; convert to Resilient internal representation	boolean
1st_condition_comparison_method	optional	The method used to compare the value, [equals, gt, lte]. Look up MethodName datatype in the API	string
2nd_condition_field_name	optional	The field name in the condition	string
2nd_condition_field_value	optional	The value used for comparison	string
2nd_condition_value_is_datetime	optional	The value is a datetime	boolean
2nd_condition_comparison_method	optional	The method used to compare the value	string
3rd_condition_field_name	optional	The field name in the condition	string
3rd_condition_field_value	optional	The value used for comparison	string
3rd_condition_value_is_datetime	optional	The value is a datetime	boolean
3rd_condition_comparison_method	optional	The method used to compare the value	string
4th_condition_field_name	optional	The field name in the condition	string
4th_condition_field_value	optional	The value used for comparison	string
4th_condition_value_is_datetime	optional	The value is a datetime	boolean
4th_condition_comparison_method	optional	The method used to compare the value	string
5th_condition_field_name	optional	The field name in the condition	string
5th_condition_field_value	optional	The value used for comparison	string
5th_condition_value_is_datetime	optional	The value is a datetime	boolean
5th_condition_comparison_method	optional	The method used to compare the value	string

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.1st_condition_comparison_method	string
action_result.parameter.1st_condition_field_name	string
action_result.parameter.1st_condition_field_value	string
action_result.parameter.1st_condition_value_is_datetime	boolean
action_result.parameter.2nd_condition_comparison_method	string
action_result.parameter.2nd_condition_field_name	string
action_result.parameter.2nd_condition_field_value	string
action_result.parameter.2nd_condition_value_is_datetime	boolean
action_result.parameter.3rd_condition_comparison_method	string
action_result.parameter.3rd_condition_field_name	string
action_result.parameter.3rd_condition_field_value	string
action_result.parameter.3rd_condition_value_is_datetime	boolean
action_result.parameter.4th_condition_comparison_method	string
action_result.parameter.4th_condition_field_name	string
action_result.parameter.4th_condition_field_value	string
action_result.parameter.4th_condition_value_is_datetime	boolean
action_result.parameter.5th_condition_comparison_method	string
action_result.parameter.5th_condition_field_name	string
action_result.parameter.5th_condition_field_value	string
action_result.parameter.5th_condition_value_is_datetime	boolean
action_result.parameter.add_condition_all_active_tickets	boolean
action_result.parameter.add_condition_closed_in_last_24_hours	boolean
action_result.parameter.add_condition_created_in_last_24_hours	boolean
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.querydto	string
action_result.data.*.addr	string
action_result.data.*.admin_id	string
action_result.data.*.artifacts	string
action_result.data.*.assessment	string
action_result.data.*.city	string
action_result.data.*.cm.total	numeric
action_result.data.*.cm.unassigneds.*.count	numeric
action_result.data.*.cm.unassigneds.*.geo	numeric
action_result.data.*.comments	string
action_result.data.*.confirmed	boolean
action_result.data.*.country	string
action_result.data.*.create_date	numeric
action_result.data.*.creator.create_date	numeric
action_result.data.*.creator.display_name	string
action_result.data.*.creator.email	string	email
action_result.data.*.creator.fname	string
action_result.data.*.creator.id	numeric
action_result.data.*.creator.is_external	boolean
action_result.data.*.creator.last_login	numeric
action_result.data.*.creator.last_modified_time	numeric
action_result.data.*.creator.lname	string
action_result.data.*.creator.locked	boolean
action_result.data.*.creator.password_changed	boolean
action_result.data.*.creator.status	string
action_result.data.*.creator_id	numeric
action_result.data.*.creator_principal.display_name	string
action_result.data.*.creator_principal.id	numeric
action_result.data.*.creator_principal.name	string	email
action_result.data.*.creator_principal.type	string
action_result.data.*.crimestatus_id	numeric
action_result.data.*.data_compromised	boolean
action_result.data.*.description	string
action_result.data.*.discovered_date	numeric
action_result.data.*.draft	boolean
action_result.data.*.due_date	string
action_result.data.*.employee_involved	string
action_result.data.*.end_date	string
action_result.data.*.exposure	numeric
action_result.data.*.exposure_dept_id	string
action_result.data.*.exposure_individual_name	string
action_result.data.*.exposure_type_id	numeric
action_result.data.*.exposure_vendor_id	string
action_result.data.*.gdpr.gdpr_breach_type	string
action_result.data.*.gdpr.gdpr_breach_type_comment	string
action_result.data.*.gdpr.gdpr_consequences	string
action_result.data.*.gdpr.gdpr_consequences_comment	string
action_result.data.*.gdpr.gdpr_final_assessment	string
action_result.data.*.gdpr.gdpr_final_assessment_comment	string
action_result.data.*.gdpr.gdpr_identification	string
action_result.data.*.gdpr.gdpr_identification_comment	string
action_result.data.*.gdpr.gdpr_personal_data	string
action_result.data.*.gdpr.gdpr_personal_data_comment	string
action_result.data.*.gdpr.gdpr_subsequent_notification	string
action_result.data.*.hard_liability	numeric
action_result.data.*.hipaa.hipaa_acquired	string
action_result.data.*.hipaa.hipaa_acquired_comment	string
action_result.data.*.hipaa.hipaa_additional_misuse	string
action_result.data.*.hipaa.hipaa_additional_misuse_comment	string
action_result.data.*.hipaa.hipaa_adverse	string
action_result.data.*.hipaa.hipaa_adverse_comment	string
action_result.data.*.hipaa.hipaa_breach	string
action_result.data.*.hipaa.hipaa_breach_comment	string
action_result.data.*.hipaa.hipaa_misused	string
action_result.data.*.hipaa.hipaa_misused_comment	string
action_result.data.*.id	numeric	ibm resilient ticketid
action_result.data.*.inc_last_modified_date	numeric
action_result.data.*.inc_start	string
action_result.data.*.inc_training	boolean
action_result.data.*.incident_type_ids	numeric
action_result.data.*.is_scenario	boolean
action_result.data.*.jurisdiction_name	string
action_result.data.*.jurisdiction_reg_id	string
action_result.data.*.name	string
action_result.data.*.negative_pr_likely	string
action_result.data.*.nist_attack_vectors	numeric
action_result.data.*.org_handle	numeric
action_result.data.*.org_id	numeric
action_result.data.*.owner_id	numeric
action_result.data.*.perms.assign	boolean
action_result.data.*.perms.attach_file	boolean
action_result.data.*.perms.change_members	boolean
action_result.data.*.perms.change_workspace	boolean
action_result.data.*.perms.close	boolean
action_result.data.*.perms.comment	boolean
action_result.data.*.perms.create_artifacts	boolean
action_result.data.*.perms.create_milestones	boolean
action_result.data.*.perms.delete	boolean
action_result.data.*.perms.delete_attachments	boolean
action_result.data.*.perms.list_artifacts	boolean
action_result.data.*.perms.list_milestones	boolean
action_result.data.*.perms.read	boolean
action_result.data.*.perms.read_attachments	boolean
action_result.data.*.perms.write	boolean
action_result.data.*.phase_id	numeric
action_result.data.*.pii.alberta_health_risk_assessment	string
action_result.data.*.pii.assessment	string
action_result.data.*.pii.data_compromised	boolean
action_result.data.*.pii.data_contained	string
action_result.data.*.pii.data_encrypted	string
action_result.data.*.pii.data_format	numeric
action_result.data.*.pii.determined_date	numeric
action_result.data.*.pii.exposure	numeric
action_result.data.*.pii.gdpr_harm_risk	string
action_result.data.*.pii.harmstatus_id	numeric
action_result.data.*.pii.impact_likely	string
action_result.data.*.pii.ny_impact_likely	string
action_result.data.*.plan_status	string
action_result.data.*.regulators.ids	numeric
action_result.data.*.reporter	string
action_result.data.*.resolution_id	string
action_result.data.*.resolution_summary	string
action_result.data.*.severity_code	numeric
action_result.data.*.severity_code.name	string
action_result.data.*.start_date	string
action_result.data.*.state	string
action_result.data.*.tasks	string
action_result.data.*.vers	numeric
action_result.data.*.workspace	numeric
action_result.data.*.zip	string
action_result.summary.Number of incidents	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'list artifacts'

List all artifacts for incident

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
incident_id	required	ID of incident	string	ibm resilient ticketid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.incident_id	string
action_result.data.*.attachment	string
action_result.data.*.created	numeric
action_result.data.*.creator.create_date	numeric
action_result.data.*.creator.display_name	string
action_result.data.*.creator.email	string	email
action_result.data.*.creator.fname	string
action_result.data.*.creator.id	numeric
action_result.data.*.creator.is_external	boolean
action_result.data.*.creator.last_login	numeric
action_result.data.*.creator.last_modified_time	numeric
action_result.data.*.creator.lname	string
action_result.data.*.creator.locked	boolean
action_result.data.*.creator.password_changed	boolean
action_result.data.*.creator.status	string
action_result.data.*.creator_principal.display_name	string
action_result.data.*.creator_principal.id	numeric
action_result.data.*.creator_principal.name	string	email
action_result.data.*.creator_principal.type	string
action_result.data.*.description	string
action_result.data.*.hash	string	sha256
action_result.data.*.id	numeric	artifactid
action_result.data.*.inc_id	numeric	ibm resilient ticketid
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.ip.destination	string
action_result.data.*.ip.source	string
action_result.data.*.parent_id	string
action_result.data.*.perms.delete	boolean
action_result.data.*.perms.read	boolean
action_result.data.*.perms.write	boolean
action_result.data.*.properties	string
action_result.data.*.relating	string
action_result.data.*.type	numeric
action_result.data.*.value	string	url
action_result.summary.Number of artifacts	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get artifact'

Get artifact details by incident and artifact id

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
incident_id	required	ID of incident	string	ibm resilient ticketid
artifact_id	required	ID of artifact to retrieve	string	artifactid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.artifact_id	string
action_result.parameter.incident_id	string
action_result.data.*.attachment	string
action_result.data.*.created	numeric
action_result.data.*.creator.create_date	numeric
action_result.data.*.creator.display_name	string
action_result.data.*.creator.email	string	email
action_result.data.*.creator.fname	string
action_result.data.*.creator.id	numeric
action_result.data.*.creator.is_external	boolean
action_result.data.*.creator.last_login	numeric
action_result.data.*.creator.last_modified_time	numeric
action_result.data.*.creator.lname	string
action_result.data.*.creator.locked	boolean
action_result.data.*.creator.password_changed	boolean
action_result.data.*.creator.status	string
action_result.data.*.creator_principal.display_name	string
action_result.data.*.creator_principal.id	numeric
action_result.data.*.creator_principal.name	string	email
action_result.data.*.creator_principal.type	string
action_result.data.*.description	string
action_result.data.*.hash	string	sha256
action_result.data.*.id	numeric	artifactid
action_result.data.*.inc_id	numeric	ibm resilient ticketid
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.ip.destination	string
action_result.data.*.ip.source	string
action_result.data.*.parent_id	string
action_result.data.*.perms.delete	boolean
action_result.data.*.perms.read	boolean
action_result.data.*.perms.write	boolean
action_result.data.*.properties	string
action_result.data.*.relating	string
action_result.data.*.type	numeric
action_result.data.*.value	string	url
action_result.summary.Number of artifacts	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'create artifact'

Create new artifact

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
incident_id	required	ID of incident	string	ibm resilient ticketid
incidentartifactdto	optional	Artifact data as JSON String, format is IncidentArtifactDTO data type from API	string
type	optional	Type of artifact	string
value	optional	Artifact value field	string
description	optional	Short description of artifact	string

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.description	string
action_result.parameter.incident_id	string
action_result.parameter.incidentartifactdto	string
action_result.parameter.type	string
action_result.parameter.value	string	url
action_result.data.*.attachment	string
action_result.data.*.created	numeric
action_result.data.*.creator.create_date	numeric
action_result.data.*.creator.display_name	string
action_result.data.*.creator.email	string	email
action_result.data.*.creator.fname	string
action_result.data.*.creator.id	numeric
action_result.data.*.creator.is_external	boolean
action_result.data.*.creator.last_login	numeric
action_result.data.*.creator.last_modified_time	numeric
action_result.data.*.creator.lname	string
action_result.data.*.creator.locked	boolean
action_result.data.*.creator.password_changed	boolean
action_result.data.*.creator.status	string
action_result.data.*.creator_principal.display_name	string
action_result.data.*.creator_principal.id	numeric
action_result.data.*.creator_principal.name	string	email
action_result.data.*.creator_principal.type	string
action_result.data.*.description	string
action_result.data.*.hash	string	sha256
action_result.data.*.id	numeric	artifactid
action_result.data.*.inc_id	numeric	ibm resilient ticketid
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.ip.destination	string
action_result.data.*.ip.source	string
action_result.data.*.parent_id	string
action_result.data.*.pending_sources	numeric
action_result.data.*.perms.delete	boolean
action_result.data.*.perms.read	boolean
action_result.data.*.perms.write	boolean
action_result.data.*.properties	string
action_result.data.*.relating	string
action_result.data.*.type	numeric
action_result.data.*.value	string	url
action_result.summary.Number of artifacts	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'update artifact'

Update existing artifact

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
incident_id	required	ID of incident	string	ibm resilient ticketid
artifact_id	required	ID of artifact to update	string	artifactid
incidentartifactdto	required	Artifact data as JSON String, format is IncidentArtifactDTO data type from API	string

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.artifact_id	string
action_result.parameter.incident_id	string
action_result.parameter.incidentartifactdto	string
action_result.data.*.attachment	string
action_result.data.*.created	numeric
action_result.data.*.creator.create_date	numeric
action_result.data.*.creator.display_name	string
action_result.data.*.creator.email	string	email
action_result.data.*.creator.fname	string
action_result.data.*.creator.id	numeric
action_result.data.*.creator.is_external	boolean
action_result.data.*.creator.last_login	numeric
action_result.data.*.creator.last_modified_time	numeric
action_result.data.*.creator.lname	string
action_result.data.*.creator.locked	boolean
action_result.data.*.creator.password_changed	boolean
action_result.data.*.creator.status	string
action_result.data.*.creator_principal.display_name	string
action_result.data.*.creator_principal.id	numeric
action_result.data.*.creator_principal.name	string	email
action_result.data.*.creator_principal.type	string
action_result.data.*.description	string
action_result.data.*.hash	string	sha256
action_result.data.*.id	numeric	artifactid
action_result.data.*.inc_id	numeric	ibm resilient ticketid
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.ip.destination	string
action_result.data.*.ip.source	string
action_result.data.*.parent_id	string
action_result.data.*.perms.delete	boolean
action_result.data.*.perms.read	boolean
action_result.data.*.perms.write	boolean
action_result.data.*.properties	string
action_result.data.*.relating	string
action_result.data.*.type	numeric
action_result.data.*.value	string	url
action_result.summary.Number of artifacts	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'list comments'

List all comment for incident

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string
action_result.data.*.comment_perms.delete	boolean
action_result.data.*.comment_perms.update	boolean
action_result.data.*.create_date	numeric
action_result.data.*.id	numeric	ibm resilient commentid
action_result.data.*.inc_id	numeric	ibm resilient ticketid
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.is_deleted	boolean
action_result.data.*.modify_date	numeric
action_result.data.*.modify_principal.display_name	string
action_result.data.*.modify_principal.id	numeric
action_result.data.*.modify_principal.name	string	email
action_result.data.*.modify_principal.type	string
action_result.data.*.modify_user.first_name	string
action_result.data.*.modify_user.id	numeric
action_result.data.*.modify_user.last_name	string
action_result.data.*.parent_id	string
action_result.data.*.task_at_id	string
action_result.data.*.task_custom	string
action_result.data.*.task_id	string
action_result.data.*.task_members	string
action_result.data.*.task_name	string
action_result.data.*.text	string
action_result.data.*.text.content	string
action_result.data.*.text.format	string
action_result.data.*.type	string
action_result.data.*.user_fname	string
action_result.data.*.user_id	numeric
action_result.data.*.user_lname	string
action_result.data.*.user_name	string
action_result.summary.Number of comments	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get comment'

Get comment details by incident and comment id

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid
comment_id	required	ID of comment to retrieve	string	ibm resilient commentid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.comment_id	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string
action_result.data.*.children.*.comment_perms.delete	boolean
action_result.data.*.children.*.comment_perms.update	boolean
action_result.data.*.children.*.create_date	numeric
action_result.data.*.children.*.id	numeric
action_result.data.*.children.*.inc_id	numeric
action_result.data.*.children.*.inc_name	string
action_result.data.*.children.*.inc_owner	numeric
action_result.data.*.children.*.is_deleted	boolean
action_result.data.*.children.*.modify_date	numeric
action_result.data.*.children.*.modify_principal.display_name	string
action_result.data.*.children.*.modify_principal.id	numeric
action_result.data.*.children.*.modify_principal.name	string	email
action_result.data.*.children.*.modify_principal.type	string
action_result.data.*.children.*.modify_user.first_name	string
action_result.data.*.children.*.modify_user.id	numeric
action_result.data.*.children.*.modify_user.last_name	string
action_result.data.*.children.*.parent_id	numeric
action_result.data.*.children.*.task_at_id	string
action_result.data.*.children.*.task_custom	string
action_result.data.*.children.*.task_id	string
action_result.data.*.children.*.task_members	string
action_result.data.*.children.*.task_name	string
action_result.data.*.children.*.text	string
action_result.data.*.children.*.type	string
action_result.data.*.children.*.user_fname	string
action_result.data.*.children.*.user_id	numeric
action_result.data.*.children.*.user_lname	string
action_result.data.*.children.*.user_name	string
action_result.data.*.comment_perms.delete	boolean
action_result.data.*.comment_perms.update	boolean
action_result.data.*.create_date	numeric
action_result.data.*.id	numeric	ibm resilient commentid
action_result.data.*.inc_id	numeric	ibm resilient ticketid
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.is_deleted	boolean
action_result.data.*.modify_date	numeric
action_result.data.*.modify_principal.display_name	string
action_result.data.*.modify_principal.id	numeric
action_result.data.*.modify_principal.name	string	email
action_result.data.*.modify_principal.type	string
action_result.data.*.modify_user.first_name	string
action_result.data.*.modify_user.id	numeric
action_result.data.*.modify_user.last_name	string
action_result.data.*.parent_id	string
action_result.data.*.task_at_id	string
action_result.data.*.task_custom	string
action_result.data.*.task_id	string
action_result.data.*.task_members	string
action_result.data.*.task_name	string
action_result.data.*.text	string
action_result.data.*.type	string
action_result.data.*.user_fname	string
action_result.data.*.user_id	numeric
action_result.data.*.user_lname	string
action_result.data.*.user_name	string
action_result.summary.Number of comments	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'create comment'

Create new comment

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid
parent_id	optional	The ID of the initial comment if posting a reply	string	ibm resilient commentid
text	optional	Comment as text	string
incidentcommentdto	optional	Comment data as JSON String, format is IncidentCommentDTO data type from API	string

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string
action_result.parameter.incidentcommentdto	string
action_result.parameter.parent_id	string	ibm resilient commentid
action_result.parameter.text	string
action_result.data.*.comment_perms.delete	boolean
action_result.data.*.comment_perms.update	boolean
action_result.data.*.create_date	numeric
action_result.data.*.id	numeric	ibm resilient commentid
action_result.data.*.inc_id	numeric	ibm resilient ticketid
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.is_deleted	boolean
action_result.data.*.modify_date	numeric
action_result.data.*.modify_principal.display_name	string
action_result.data.*.modify_principal.id	numeric
action_result.data.*.modify_principal.name	string	email
action_result.data.*.modify_principal.type	string
action_result.data.*.modify_user.first_name	string
action_result.data.*.modify_user.id	numeric
action_result.data.*.modify_user.last_name	string
action_result.data.*.parent_id	string
action_result.data.*.task_at_id	string
action_result.data.*.task_custom	string
action_result.data.*.task_id	string
action_result.data.*.task_members	string
action_result.data.*.task_name	string
action_result.data.*.text	string
action_result.data.*.type	string
action_result.data.*.user_fname	string
action_result.data.*.user_id	numeric
action_result.data.*.user_lname	string
action_result.data.*.user_name	string
action_result.summary.Number of comments	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'update comment'

Update existing comment

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid
comment_id	required	ID of comment to retrieve	string	ibm resilient commentid
incidentcommentdto	required	Comment data as JSON String, format is IncidentCommentDTO data type from API	string

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.comment_id	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string
action_result.parameter.incidentcommentdto	string
action_result.data.*.comment_perms.delete	boolean
action_result.data.*.comment_perms.update	boolean
action_result.data.*.create_date	numeric
action_result.data.*.id	numeric	ibm resilient commentid
action_result.data.*.inc_id	numeric	ibm resilient ticketid
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.is_deleted	boolean
action_result.data.*.modify_date	numeric
action_result.data.*.modify_principal.display_name	string
action_result.data.*.modify_principal.id	numeric
action_result.data.*.modify_principal.name	string	email
action_result.data.*.modify_principal.type	string
action_result.data.*.modify_user.first_name	string
action_result.data.*.modify_user.id	numeric
action_result.data.*.modify_user.last_name	string
action_result.data.*.parent_id	string
action_result.data.*.task_at_id	string
action_result.data.*.task_custom	string
action_result.data.*.task_id	string
action_result.data.*.task_members	string
action_result.data.*.task_name	string
action_result.data.*.text	string
action_result.data.*.type	string
action_result.data.*.user_fname	string
action_result.data.*.user_id	numeric
action_result.data.*.user_lname	string
action_result.data.*.user_name	string
action_result.summary.Number of comments	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'list tables'

List tables

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string
action_result.data	string
action_result.summary.Number of tables	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get table'

Get table

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid
table_id	required	ID of table	string	ibm resilient ticketid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string	ibm resilient ticketid
action_result.parameter.table_id	string	ibm resilient ticketid
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric
action_result.data.*.perms.update	boolean
action_result.data.*.perms.delete	boolean
action_result.data.*.inc_id	numeric
action_result.data.*.rows.*.type_id	numeric
action_result.data.*.rows.*.cells.180.row_id	numeric
action_result.data.*.rows.*.cells.180.id	numeric
action_result.data.*.rows.*.cells.180.value	string
action_result.data.*.rows.*.cells.181.row_id	numeric
action_result.data.*.rows.*.cells.181.id	numeric
action_result.data.*.rows.*.cells.181.value	numeric
action_result.data.*.rows.*.cells.179.row_id	numeric
action_result.data.*.rows.*.cells.179.id	numeric
action_result.data.*.rows.*.cells.179.value	numeric
action_result.data.*.rows.*.inc_owner	numeric
action_result.data.*.rows.*.version	numeric
action_result.data.*.rows.*.table_name	string
action_result.data.*.rows.*.inc_name	string
action_result.data.*.rows.*.inc_id	numeric
action_result.data.*.rows.*.id	numeric
action_result.data.*.id	numeric
action_result.summary.Number of tables	numeric

action: 'add table row'

Add table row

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid
table_id	required	ID of table	string	tableid
datatablerowdatadto	required	Table row as JSON String, format is DataTableRowDataDTO data type from API	string
1st_condition_cell_property	optional	The property name of the cell	string
1st_condition_cell_value	optional	The value of the cell	string
2nd_condition_cell_property	optional	The property name of the cell	string
2nd_condition_cell_value	optional	The value of the cell	string
3rd_condition_cell_property	optional	The property name of the cell	string
3rd_condition_cell_value	optional	The value of the cell	string
4th_condition_cell_property	optional	The property name of the cell	string
4th_condition_cell_value	optional	The value of the cell	string
5th_condition_cell_property	optional	The property name of the cell	string
5th_condition_cell_value	optional	The value of the cell	string

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.1st_condition_cell_property	string
action_result.parameter.1st_condition_cell_value	string
action_result.parameter.2nd_condition_cell_property	string
action_result.parameter.2nd_condition_cell_value	string
action_result.parameter.3rd_condition_cell_property	string
action_result.parameter.3rd_condition_cell_value	string
action_result.parameter.4th_condition_cell_property	string
action_result.parameter.4th_condition_cell_value	string
action_result.parameter.5th_condition_cell_property	string
action_result.parameter.5th_condition_cell_value	string
action_result.parameter.datatablerowdatadto	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string
action_result.parameter.table_id	string
action_result.data.*.cells.179.id	numeric
action_result.data.*.cells.179.row_id	numeric
action_result.data.*.cells.179.value	string
action_result.data.*.cells.180.id	numeric
action_result.data.*.cells.180.row_id	numeric
action_result.data.*.cells.180.value	string
action_result.data.*.cells.181.id	numeric
action_result.data.*.cells.181.row_id	numeric
action_result.data.*.cells.181.value	numeric
action_result.data.*.id	numeric
action_result.data.*.inc_id	numeric
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.table_name	string
action_result.data.*.type_id	numeric
action_result.data.*.version	numeric
action_result.summary.Number of table row	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'update table row'

Update table row

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid
table_id	required	ID of table	string	tableid
row_id	required	ID of row in table	string	rowid
datatablerowdatadto	required	Table row as JSON String, format is DataTableRowDataDTO data type from API	string
1st_condition_cell_property	optional	The property name of the cell	string
1st_condition_cell_value	optional	The value of the cell	string
2nd_condition_cell_property	optional	The property name of the cell	string
2nd_condition_cell_value	optional	The value of the cell	string
3rd_condition_cell_property	optional	The property name of the cell	string
3rd_condition_cell_value	optional	The value of the cell	string
4th_condition_cell_property	optional	The property name of the cell	string
4th_condition_cell_value	optional	The value of the cell	string
5th_condition_cell_property	optional	The property name of the cell	string
5th_condition_cell_value	optional	The value of the cell	string

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.1st_condition_cell_property	string
action_result.parameter.1st_condition_cell_value	string
action_result.parameter.2nd_condition_cell_property	string
action_result.parameter.2nd_condition_cell_value	string
action_result.parameter.3rd_condition_cell_property	string
action_result.parameter.3rd_condition_cell_value	string
action_result.parameter.4th_condition_cell_property	string
action_result.parameter.4th_condition_cell_value	string
action_result.parameter.5th_condition_cell_property	string
action_result.parameter.5th_condition_cell_value	string
action_result.parameter.datatablerowdatadto	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string	ibm resilient ticketid
action_result.parameter.row_id	string	rowid
action_result.parameter.table_id	string	tableid
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'update table row with key'

Update table row with key

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid
table_id	required	ID of table	string	tableid
key	required	Property name in row to find	string	ibm resilient keyid
value	required	Property value in row to find	string
datatablerowdatadto	required	Table row as JSON String, format is DataTableRowDataDTO data type from API	string

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.datatablerowdatadto	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string	ibm resilient ticketid
action_result.parameter.key	string	ibm resilient keyid
action_result.parameter.table_id	string	tableid
action_result.parameter.value	string
action_result.data	string
action_result.summary	string
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'list tasks'

List tasks for user (defined in asset configuration)

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.handle_format_is_name	boolean
action_result.data.*.inc.addr	string
action_result.data.*.inc.admin_id	string
action_result.data.*.inc.assessment	string
action_result.data.*.inc.city	string
action_result.data.*.inc.confirmed	boolean
action_result.data.*.inc.country	string
action_result.data.*.inc.create_date	numeric
action_result.data.*.inc.creator.create_date	numeric
action_result.data.*.inc.creator.display_name	string
action_result.data.*.inc.creator.email	string	email
action_result.data.*.inc.creator.fname	string
action_result.data.*.inc.creator.id	numeric
action_result.data.*.inc.creator.is_external	boolean
action_result.data.*.inc.creator.last_login	numeric
action_result.data.*.inc.creator.last_modified_time	numeric
action_result.data.*.inc.creator.lname	string
action_result.data.*.inc.creator.locked	boolean
action_result.data.*.inc.creator.password_changed	boolean
action_result.data.*.inc.creator.status	string
action_result.data.*.inc.creator_id	numeric
action_result.data.*.inc.creator_principal.display_name	string
action_result.data.*.inc.creator_principal.id	numeric
action_result.data.*.inc.creator_principal.name	string	email
action_result.data.*.inc.creator_principal.type	string
action_result.data.*.inc.crimestatus_id	numeric
action_result.data.*.inc.data_compromised	string
action_result.data.*.inc.description	string
action_result.data.*.inc.discovered_date	numeric
action_result.data.*.inc.draft	boolean
action_result.data.*.inc.due_date	string
action_result.data.*.inc.employee_involved	string
action_result.data.*.inc.end_date	string
action_result.data.*.inc.exposure	numeric
action_result.data.*.inc.exposure_dept_id	string
action_result.data.*.inc.exposure_individual_name	string
action_result.data.*.inc.exposure_type_id	numeric
action_result.data.*.inc.exposure_vendor_id	string
action_result.data.*.inc.gdpr.gdpr_breach_type	string
action_result.data.*.inc.gdpr.gdpr_breach_type_comment	string
action_result.data.*.inc.gdpr.gdpr_consequences	string
action_result.data.*.inc.gdpr.gdpr_consequences_comment	string
action_result.data.*.inc.gdpr.gdpr_final_assessment	string
action_result.data.*.inc.gdpr.gdpr_final_assessment_comment	string
action_result.data.*.inc.gdpr.gdpr_identification	string
action_result.data.*.inc.gdpr.gdpr_identification_comment	string
action_result.data.*.inc.gdpr.gdpr_personal_data	string
action_result.data.*.inc.gdpr.gdpr_personal_data_comment	string
action_result.data.*.inc.gdpr.gdpr_subsequent_notification	string
action_result.data.*.inc.hard_liability	numeric
action_result.data.*.inc.id	numeric
action_result.data.*.inc.inc_last_modified_date	numeric
action_result.data.*.inc.inc_start	string
action_result.data.*.inc.inc_training	boolean
action_result.data.*.inc.is_scenario	boolean
action_result.data.*.inc.jurisdiction_name	string
action_result.data.*.inc.jurisdiction_reg_id	string
action_result.data.*.inc.name	string
action_result.data.*.inc.negative_pr_likely	string
action_result.data.*.inc.org_handle	numeric
action_result.data.*.inc.org_id	numeric
action_result.data.*.inc.owner_id	numeric
action_result.data.*.inc.perms.assign	boolean
action_result.data.*.inc.perms.attach_file	boolean
action_result.data.*.inc.perms.change_members	boolean
action_result.data.*.inc.perms.change_workspace	boolean
action_result.data.*.inc.perms.close	boolean
action_result.data.*.inc.perms.comment	boolean
action_result.data.*.inc.perms.create_artifacts	boolean
action_result.data.*.inc.perms.create_milestones	boolean
action_result.data.*.inc.perms.delete	boolean
action_result.data.*.inc.perms.delete_attachments	boolean
action_result.data.*.inc.perms.list_artifacts	boolean
action_result.data.*.inc.perms.list_milestones	boolean
action_result.data.*.inc.perms.read	boolean
action_result.data.*.inc.perms.read_attachments	boolean
action_result.data.*.inc.perms.write	boolean
action_result.data.*.inc.phase_id	numeric
action_result.data.*.inc.pii.alberta_health_risk_assessment	string
action_result.data.*.inc.pii.assessment	string
action_result.data.*.inc.pii.data_compromised	string
action_result.data.*.inc.pii.data_contained	string
action_result.data.*.inc.pii.data_encrypted	string
action_result.data.*.inc.pii.data_format	string
action_result.data.*.inc.pii.determined_date	numeric
action_result.data.*.inc.pii.exposure	numeric
action_result.data.*.inc.pii.gdpr_harm_risk	string
action_result.data.*.inc.pii.harmstatus_id	numeric
action_result.data.*.inc.pii.impact_likely	string
action_result.data.*.inc.pii.ny_impact_likely	string
action_result.data.*.inc.plan_status	string
action_result.data.*.inc.reporter	string
action_result.data.*.inc.resolution_id	string
action_result.data.*.inc.resolution_summary	string
action_result.data.*.inc.severity_code	string
action_result.data.*.inc.start_date	string
action_result.data.*.inc.state	string
action_result.data.*.inc.vers	numeric
action_result.data.*.inc.workspace	numeric
action_result.data.*.inc.zip	string
action_result.data.*.tasks.*.category_id	string
action_result.data.*.tasks.*.child_tasks.*.active	boolean
action_result.data.*.tasks.*.child_tasks.*.at_id	string
action_result.data.*.tasks.*.child_tasks.*.attachments_count	numeric
action_result.data.*.tasks.*.child_tasks.*.auto_deactivate	boolean
action_result.data.*.tasks.*.child_tasks.*.cat_name	string
action_result.data.*.tasks.*.child_tasks.*.category_id	string
action_result.data.*.tasks.*.child_tasks.*.closed_date	string
action_result.data.*.tasks.*.child_tasks.*.creator_principal.display_name	string
action_result.data.*.tasks.*.child_tasks.*.creator_principal.id	numeric
action_result.data.*.tasks.*.child_tasks.*.creator_principal.name	string	email
action_result.data.*.tasks.*.child_tasks.*.creator_principal.type	string
action_result.data.*.tasks.*.child_tasks.*.custom	boolean
action_result.data.*.tasks.*.child_tasks.*.description	string
action_result.data.*.tasks.*.child_tasks.*.due_date	string
action_result.data.*.tasks.*.child_tasks.*.form	string
action_result.data.*.tasks.*.child_tasks.*.frozen	boolean
action_result.data.*.tasks.*.child_tasks.*.id	numeric
action_result.data.*.tasks.*.child_tasks.*.inc_id	numeric
action_result.data.*.tasks.*.child_tasks.*.inc_name	string
action_result.data.*.tasks.*.child_tasks.*.inc_owner_id	numeric
action_result.data.*.tasks.*.child_tasks.*.inc_training	boolean
action_result.data.*.tasks.*.child_tasks.*.init_date	numeric
action_result.data.*.tasks.*.child_tasks.*.instr_text	string
action_result.data.*.tasks.*.child_tasks.*.instructions	string
action_result.data.*.tasks.*.child_tasks.*.members	string
action_result.data.*.tasks.*.child_tasks.*.name	string
action_result.data.*.tasks.*.child_tasks.*.notes_count	numeric
action_result.data.*.tasks.*.child_tasks.*.owner_fname	string
action_result.data.*.tasks.*.child_tasks.*.owner_id	numeric
action_result.data.*.tasks.*.child_tasks.*.owner_lname	string
action_result.data.*.tasks.*.child_tasks.*.perms.assign	boolean
action_result.data.*.tasks.*.child_tasks.*.perms.attach_file	boolean
action_result.data.*.tasks.*.child_tasks.*.perms.change_members	boolean
action_result.data.*.tasks.*.child_tasks.*.perms.close	boolean
action_result.data.*.tasks.*.child_tasks.*.perms.comment	boolean
action_result.data.*.tasks.*.child_tasks.*.perms.delete_attachments	boolean
action_result.data.*.tasks.*.child_tasks.*.perms.read	boolean
action_result.data.*.tasks.*.child_tasks.*.perms.read_attachments	boolean
action_result.data.*.tasks.*.child_tasks.*.perms.write	boolean
action_result.data.*.tasks.*.child_tasks.*.phase_id	numeric
action_result.data.*.tasks.*.child_tasks.*.private	string
action_result.data.*.tasks.*.child_tasks.*.required	boolean
action_result.data.*.tasks.*.child_tasks.*.src_name	string
action_result.data.*.tasks.*.child_tasks.*.status	string
action_result.data.*.tasks.*.child_tasks.*.task_layout	string
action_result.data.*.tasks.*.child_tasks.*.user_notes	string
action_result.data.*.tasks.*.id	string
action_result.data.*.tasks.*.name	string
action_result.data.*.tasks.*.parent_id	string
action_result.data.*.tasks.*.phase_id	numeric
action_result.data.*.tasks.*.status	string
action_result.summary.Number of tasks	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get task'

Get task details

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
task_id	required	ID of incident	string	ibm resilient taskid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.task_id	string
action_result.data.*.active	boolean
action_result.data.*.at_id	string
action_result.data.*.attachments_count	numeric
action_result.data.*.auto_deactivate	boolean
action_result.data.*.cat_name	string
action_result.data.*.category_id	numeric
action_result.data.*.closed_date	string
action_result.data.*.creator_principal.display_name	string
action_result.data.*.creator_principal.id	numeric
action_result.data.*.creator_principal.name	string	email
action_result.data.*.creator_principal.type	string
action_result.data.*.custom	boolean
action_result.data.*.description	string
action_result.data.*.due_date	string
action_result.data.*.form	string
action_result.data.*.frozen	boolean
action_result.data.*.id	numeric
action_result.data.*.inc_id	numeric
action_result.data.*.inc_name	string
action_result.data.*.inc_owner_id	numeric
action_result.data.*.inc_training	boolean
action_result.data.*.init_date	numeric
action_result.data.*.instr_text	string
action_result.data.*.instructions	string
action_result.data.*.members	string
action_result.data.*.name	string
action_result.data.*.notes_count	numeric
action_result.data.*.owner_fname	string
action_result.data.*.owner_id	string
action_result.data.*.owner_lname	string
action_result.data.*.perms.assign	boolean
action_result.data.*.perms.attach_file	boolean
action_result.data.*.perms.change_members	boolean
action_result.data.*.perms.close	boolean
action_result.data.*.perms.comment	boolean
action_result.data.*.perms.delete_attachments	boolean
action_result.data.*.perms.read	boolean
action_result.data.*.perms.read_attachments	boolean
action_result.data.*.perms.write	boolean
action_result.data.*.phase_id	numeric
action_result.data.*.private	string
action_result.data.*.regs.88	string
action_result.data.*.required	boolean
action_result.data.*.src_name	string
action_result.data.*.status	string
action_result.data.*.user_notes	string
action_result.summary.Number of tasks	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'update task'

Update task. This action downloads the task and copy the provided json onto the download data, overwriting any existing data elements

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
task_id	required	ID of incident	string	ibm resilient taskid
taskdto	required	Table row as JSON String, format is TaskDTO data type from API	string

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.task_id	string
action_result.parameter.taskdto	string
action_result.data.*.message	string
action_result.data.*.success	boolean
action_result.data.*.title	string
action_result.summary.Number of tasks	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'close task'

Close task

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
task_id	required	ID of incident	string	ibm resilient taskid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.task_id	string
action_result.data.*.message	string
action_result.data.*.success	boolean
action_result.data.*.title	string
action_result.summary.Number of tasks	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'list attachments'

List attachments for incident

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string
action_result.data.*.content_type	string
action_result.data.*.created	numeric
action_result.data.*.creator_id	numeric
action_result.data.*.id	numeric
action_result.data.*.inc_id	numeric
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.name	string
action_result.data.*.size	numeric
action_result.data.*.task_at_id	string
action_result.data.*.task_custom	string
action_result.data.*.task_id	string
action_result.data.*.task_members	string
action_result.data.*.task_name	string
action_result.data.*.type	string
action_result.data.*.uuid	string
action_result.data.*.vers	numeric
action_result.summary.Number of attachments	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'get attachment'

Get attachment details from incident

Type: investigate
Read only: True

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid
attachment_id	required	ID of attachment	string	ibm resilient attachmentid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.attachment_id	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string
action_result.data.*.content_type	string
action_result.data.*.created	numeric
action_result.data.*.creator_id	numeric
action_result.data.*.id	numeric
action_result.data.*.inc_id	numeric
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.name	string
action_result.data.*.size	numeric
action_result.data.*.task_at_id	string
action_result.data.*.task_custom	string
action_result.data.*.task_id	string
action_result.data.*.task_members	string
action_result.data.*.task_name	string
action_result.data.*.type	string
action_result.data.*.uuid	string
action_result.data.*.vers	numeric
action_result.summary.Number of attachments	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric

action: 'add attachment'

Add attachment to incident

Type: generic
Read only: False

Action Parameters

PARAMETER	REQUIRED	DESCRIPTION	TYPE	CONTAINS
handle_format_is_name	optional	Treat handles as a name. Default is true	boolean
incident_id	required	ID of incident	string	ibm resilient ticketid
vault_id	required	Vault ID of file	string	vaultid

Action Output

DATA PATH	TYPE	CONTAINS
action_result.status	string
action_result.parameter.handle_format_is_name	boolean
action_result.parameter.incident_id	string
action_result.parameter.vault_id	string	sha1 vault id
action_result.data.*.content_type	string
action_result.data.*.created	numeric
action_result.data.*.creator_id	numeric
action_result.data.*.id	numeric
action_result.data.*.inc_id	numeric
action_result.data.*.inc_name	string
action_result.data.*.inc_owner	numeric
action_result.data.*.name	string
action_result.data.*.size	numeric
action_result.data.*.task_at_id	string
action_result.data.*.task_custom	string
action_result.data.*.task_id	string
action_result.data.*.task_members	string
action_result.data.*.task_name	string
action_result.data.*.type	string
action_result.data.*.uuid	string
action_result.data.*.vers	numeric
action_result.summary.Number of attachments	numeric
action_result.message	string
summary.total_objects	numeric
summary.total_objects_successful	numeric