| Methodology | REST API based: Caller makes an HTTPS request with an input JSON containing the updated incident attributes |
| Request URL | https://<FortiSIEM_Supervisor_IP>/phoenix
/rest/incident/external
|
| Input Credentials | - Enterprise deployments: User name and password of any FortiSIEM account that has the appropriate access. Use "super" as the organization for Enterprise deployments.
Curl example: curl -k -u super/admin:Admin*123 - Service Provider deployments: User name and password of Super Global account or Organization specific account and name. Make sure that the account has the appropriate access.
Curl example with super organization: curl -k -u super/admin:Admin*123
If querying for a specific organization, replace "super" with the organization name.
|
| Input JSON | ContentType: application/json
RequestPayload:{"incidentId":"1","comments":"XYZ","incidentStatus":
"3","externalTicketType":"MEDIUM","externalTicketId":
"1111","externalTicketState":"CLOSED",
"externalAssignedUser":"ABC"}
incidentId – Incident ID for the incident to be updatedcomments – Any commentsincidentStatus – 0 (Active), 1 (Auto Cleared), 2 (Manually Cleared), or 3 (System Cleared)externalTicketType – Low, Medium, or HighexternalTicketId – External Ticket IDexternalTicketState – New, Assigned, In Progress, or ClosedexternalAssignedUser – External Assigned User
|
