IBM Resilient Systems

Case management that enables visibility across your tools for continual IR improvement.

Category

Case Management

Pack

IBMResilientSystems

Configuration parameters

• server — Server URL (e.g. 192.168.0.1) (required)
• org — Organization name (required)
• api_key_id — API key ID
• api_key_secret — API key secret
• credentials_api_key — API key ID
• credentials — Credentials (Deprecated - use API Key authentication instead)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• isFetch — Fetch incidents
• fetch_closed — Fetch closed incidents
• fetch_notes — Fetch notes
• fetch_tasks — Fetch tasks
• fetch_time — First fetch timestamp (YYYY-MM-DDTHH:MM:SSZ). For example: 2020-02-02T19:00:00Z
• max_fetch — Maximum incidents to fetch.
• mirror_direction — Incident Mirroring Direction
• close_xsoar_incident — Close Mirrored XSOAR Incidents
• close_ibm_incident — Close Mirrored IBM Resilient Incidents
• tag_from_ibm — Tag from IBM Qradar SOAR
• tag_to_ibm — Tag to IBM QRadar SOAR

Commands (31)

• get-mapping-fields — Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.
• get-modified-remote-data — Returns the list of incidents IDs that were modified since the last update time. Note that this method is for debugging purposes. The get-modified-remote-data command is used as part of the mirroring feature, which is available from version 6.1.
• get-remote-data — Get remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes only.
• rs-add-artifact — Add an artifact to an incident.
• rs-add-custom-task — Adds a custom task to the specified incident.
• rs-add-note — Add a note to an incident.
• rs-close-incident — Closes an incident.
• rs-create-incident — Creates an incident.
• rs-delete-incidents — Delete multiple incidents.
• rs-delete-task-members — Delete a task's member. This effectively changes the task from a "private" task to a non-private task (to one where any incident member can operate on it).
• rs-delete-tasks — Deletes a specified list of tasks. Note that only custom tasks can be deleted.
• rs-get-attachment — Gets incident attachment's name and contents as a file by its ID.
• rs-get-incident — Gets an individual incident by ID.
• rs-get-task-members — Get the members of a task. Private tasks will have the returned "members" property set. Non-private tasks will have a null "members" property.
• rs-get-users — Gets a list of all users in the system.
• rs-incident-artifacts — Gets incident artifacts.
• rs-incident-attachments — Gets incident attachments.
• rs-incidents-get-members — Gets members of the incident.
• rs-incidents-get-tasks — Gets tasks of incidents.
• rs-incidents-update-member — Updates the incident's members.
• rs-list-incident-notes — Gets all of the top-level comments for an incident.
• rs-list-scripts — Retrieves the specified script's information or a list of all organization's scripts.
• rs-list-task-instructions — Get the task's instructions.
• rs-list-tasks — Gets an array of open tasks to which the current user is assigned.
• rs-related-incidents — Gets related incidents.
• rs-search-incidents — Query for incidents.
• rs-update-incident — Updates incidents.
• rs-update-incident-note — Updates an incident's note.
• rs-update-task — Update an incident's task fields.
• rs-upload-incident-attachment — Upload an attachment for an incident.
• update-remote-system — Updates the remote incident with local incident changes. This method is only used for debugging purposes and will not update the current incident.