IBM Resilient Systems

Case management that enables visibility across your tools for continual IR improvement.

Configure IBM Resilient Systems in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

rs-search-incidents

Query for incidents

Base Command

rs-search-incidents

Input

Context Output

rs-update-incident

Updates incidents.

Base Command

rs-update-incident

Input

Context Output

There is no context output for this command.

Command Example

!rs-update-incident incident-id=1234 severity=High incident-type=Malware

Human Readable Output

Incident 1234 was updated successfully.

rs-incidents-get-members

Gets members of the incident.

Base Command

rs-incidents-get-members

Input

Context Output

Command Example

!rs-incidents-get-members incident-id=1234

Context Example

{
    "Resilient": {
        "Incidents": {
            "Id": "1234",
            "Members": [
                {
                    "Email": "example@example.com",
                    "FirstName": "example",
                    "ID": 1,
                    "LastName": "example"
                }
            ]
        }
    }
}

Human Readable Output

Members of incident 1234

ID	LastName	FirstName	Email
1	example	example	example@example.com

rs-get-incident

Gets an individual incident by ID.

Base Command

rs-get-incident

Input

Context Output

rs-get-incident

Gets an individual incident by ID.

Base Command

rs-get-incident

Input

Context Output

    "Incidents": {
        "Id": "1234",
        "Members": {
            "Email": "example@exampe.com",
            "FirstName": "example",
            "ID": 2,
            "LastName": "example",
            "members": [],
            "vers": 10
        }
    }
} }

#### Human Readable Output

>### Members of incident 1234
>|Email|FirstName|ID|LastName|members|vers|
>|---|---|---|---|---|---|
>| example@example.com | example | 2 | example |  | 10 |


### rs-get-users
***
Gets a list of all users in the system.


#### Base Command

`rs-get-users`
#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example
```!rs-get-users```

#### Human Readable Output

>### IBM Resilient Systems Users
>|ID|LastName|FirstName|Email|
>|---|---|---|---|
>| 1 | example | example | example@example.com |
>| 2 | example1 | example1 | example1@example.com |


### rs-close-incident
***
Closes an incident.


#### Base Command

`rs-close-incident`
#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident-id | ID of the incident to close. | Required | 


#### Context Output

There is no context output for this command.

#### Command Example
```!rs-close-incident incident-id=1234```

#### Human Readable Output

>Incident 1234 was closed.

### rs-create-incident
***
Creates an incident.


#### Base Command

`rs-create-incident`
#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| name | Incident name. | Required | 


#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Resilient.Incidents.Id | string | Incident ID. | 
| Resilient.Incidents.Name | string | Incident name. | 


#### Command Example
```!rs-create-incident name=IncidentName```

#### Context Example
```json
{
    "Resilient": {
        "Incidents": {
            "Id": "1235",
            "Name": "IncidentName"
        }
    }
}

Human Readable Output

Incident IncidentName was created

ID	Name
1235	IncidentName

rs-incident-artifacts

Gets incident artifacts.

Base Command

rs-incident-artifacts

Input

Context Output

Command Example

!rs-incident-artifacts incident-id=1234

Context Example

{
    "Resilient": {
        "Incidents": {
            "Artifacts": [
                {
                    "CreatedDate": "2000-00-00T00:00:00Z",
                    "Creator": "example example",
                    "Description": "example",
                    "ID": 1,
                    "Type": "IP Address",
                    "Value": "1.1.1.1"
                },
                {
                    "CreatedDate": "2000-00-00T00:00:00Z",
                    "Creator": "example example",
                    "Description": "example",
                    "ID": 2,
                    "Type": "IP Address",
                    "Value": "2.2.2.2"
                }
             ],
            "Id": "1234",
            "Name": "example"
        }
    }
}

Human Readable Output

Incident 1234 artifacts

ID	Value	Description	CreatedDate	Creator
1	1.1.1.1	example	2000-00-00T00:00:00Z	example example
2	2.2.2.2	example	2000-00-00T00:00:00Z	example example

rs-incident-attachments

Gets incident attachments.

Base Command

rs-incident-attachments

Input

Context Output

Command Example

!rs-incident-attachments incident-id=1234

Context Example

{
    "Resilient": {
        "Incidents": {
            "Attachments": [
                {
                    "ContentType": "example",
                    "CreatedDate": "2000-00-00T00:00:00Z",
                    "Creator": "example example",
                    "ID": 1,
                    "Name": "example",
                    "Size": 10
                }
            ],
            "Id": "1234",
            "Name": "example",
            "Owner": "example example"
        }
    }
}

Human Readable Output

Incident 1234 attachments

ContentType	CreatedDate	Creator	ID	Name	Size
example	2000-00-00T00:00:00Z	example example	1	example	10

rs-related-incidents

Gets related incidents.

Base Command

rs-related-incidents

Input

Context Output

Command Example

!rs-related-incidents incident-id=1234

Context Example

{
    "Resilient": {
        "Incidents": {
            "Id": "1234",
            "Related": [
                {
                    "Artifacts": [
                        {
                            "CreatedDate": "2000-00-00T00:00:00Z",
                            "Creator": "example example",
                            "ID": 1
                        },
                        {
                            "CreatedDate": "2000-00-00T00:00:00Z",
                            "Creator": "example example",
                            "Description": "example",
                            "ID": 2
                        }
                    ],
                    "CreatedDate": "2000-00-00T00:00:00Z",
                    "ID": 1235,
                    "Name": "example",
                    "Status": "Closed"
                }
            ]
        }
    }
}

Human Readable Output

Incident 1234 related incidents

Artifacts	CreatedDate	ID	Name	Status
ID: 1 Created Date: 2000-00-00T00:00:00Z Creator: example example ID: 2 Created Date: 2000-00-00T00:00:00Z Description: example Creator: example example	2000-00-00T00:00:00Z	1234	example	Closed

rs-incidents-get-tasks

Gets tasks of incidents.

Base Command

rs-incidents-get-tasks

Input

Context Output

Command Example

!rs-incidents-get-tasks incident-id=1234

Context Example

{
    "Resilient": {
        "Incidents": {
            "Id": "1234",
            "Name": "example",
            "Tasks": [
                {
                    "Category": "Respond",
                    "Creator": "example example",
                    "Form": "data_compromised, determined_date",
                    "ID": 1,
                    "Name": "example",
                    "Required": true,
                    "Status": "Open"
                }
            ]
        }
    }
}

Human Readable Output

Incident 1234 tasks

ID	Name	Category	Form	Status	DueDate	Instructions	UserNotes	Required	Creator
1	example	Respond	data_compromised, determined_date	Open				true	example example

rs-add-note

Add a note to an incident.

Base Command

rs-add-note

Input

Context Output

Command Example

!rs-add-note incident-id=1234 note="This is a note"

Context Example

{
    "Resilient": {
        "incidentNote": {
            "actions": [],
            "children": [],
            "comment_perms": {
                "delete": true,
                "update": true
            },
            "create_date": 1600000000000,
            "id": 10,
            "inc_id": 1234,
            "inc_name": "example",
            "inc_owner": 1,
            "is_deleted": false,
            "mentioned_users": [],
            "modify_date": 1600000000000,
            "modify_principal": {
                "display_name": "example example",
                "id": 1,
                "name": "example@example.com",
                "type": "user"
            },
            "modify_user": {
                "first_name": "example",
                "id": 1,
                "last_name": "example"
            },
            "parent_id": null,
            "task_at_id": null,
            "task_custom": null,
            "task_id": null,
            "task_members": null,
            "task_name": null,
            "text": "<div>This is a note</div>",
            "type": "incident",
            "user_fname": "example",
            "user_id": 1,
            "user_lname": "example",
            "user_name": "example example"
        }
    }
}

Human Readable Output

The note was added successfully to incident 1234

rs-add-artifact

Add an artifact to an incident.

Base Command

rs-add-artifact

Input

Context Output

Command Example

!rs-add-artifact artifact-type="IP Address" artifact-value=1.1.1.1 incident-id=1234 artifact-description="This is a description"

Context Example

{
    "Resilient": {
        "incidentArtifact": {
            "actions": [],
            "attachment": null,
            "created": 1600000000000,
            "creator": {
                "cell": "",
                "display_name": "example example",
                "email": "example@example.com",
                "fname": "example",
                "id": 9,
                "is_external": false,
                "lname": "example",
                "locked": false,
                "password_changed": false,
                "phone": "",
                "status": "A",
                "title": "",
                "ui_theme": "darkmode"
            },
            "creator_principal": {
                "display_name": "example example",
                "id": 1,
                "name": "example@example.com",
                "type": "user"
            },
            "description": "example",
            "hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
            "hits": [],
            "id": 1,
            "inc_id": 1234,
            "inc_name": "example",
            "inc_owner": 1,
            "ip": {
                "destination": null,
                "source": null
            },
            "last_modified_by": {
                "display_name": "example example",
                "id": 1,
                "name": "example@example.com",
                "type": "user"
            },
            "last_modified_time": 1600000000000,
            "parent_id": null,
            "pending_sources": [],
            "perms": {
                "delete": true,
                "read": true,
                "write": true
            },
            "properties": null,
            "relating": null,
            "type": 1,
            "value": "1.1.1.1"
        }
    }
}

Human Readable Output

The artifact was added successfully to incident 1234

rs-delete-incidents

Delete multiple incidents.

Base Command

rs-delete-incidents

Input

Context Output

There is no context output for this command.

rs-list-incident-notes

Gets all of the top-level comments for an incident.

Base Command

rs-list-incident-notes

Input

Context Output

rs-update-task

Update an incident’s task fields.

Base Command

rs-update-task

Input

Context Output

There is no context output for this command.

rs-add-custom-task

Adds a custom task to the specified incident.

Base Command

rs-add-custom-task

Input

Context Output

There is no context output for this command.

rs-delete-task-members

Delete a task’s member. This effectively changes the task from a “private” task to a non-private task (to one where any incident member can operate on it).

Base Command

rs-delete-task-members

Input

Context Output

There is no context output for this command.

rs-list-tasks

Gets an array of open tasks to which the current user is assigned.

Base Command

rs-list-tasks

Input

There are no input arguments for this command.

Context Output

rs-list-scripts

Retrieves the specified script’s information or a list of all organization’s scripts.

Base Command

rs-list-scripts

Input

Context Output

rs-delete-tasks

Deletes a specified list of tasks. Note that only custom tasks can be deleted.

Base Command

rs-delete-tasks

Input

Context Output

There is no context output for this command.

rs-list-task-instructions

Lists the task’s instructions.

Base Command

rs-list-task-instructions

Input

Context Output

rs-update-incident-note

Updates an incident’s note.

Base Command

rs-update-incident-note

Input

Context Output

There is no context output for this command.

rs-upload-incident-attachment

Upload an attachment for an incident.

Base Command

rs-upload-incident-attachment

Input

Context Output

There is no context output for this command.

rs-get-task-members

Get the members of a task. Private tasks will have the returned “members” property set. Non-private tasks will have a null “members” property.

Base Command

rs-get-task-members

Input

Context Output

rs-get-attachment

Gets incident attachment’s name and contents as a file by its ID.

Base Command

rs-get-attachment

Input

Context Output

There is no context output for this command.

rs-incidents-update-member

Updates incident’s members.

Base Command

rs-incidents-update-member

Input

Context Output

There is no context output for this command.