commonfields:
  id: NetwitnessSAAddEventsToIncident
  version: -1
name: NetwitnessSAAddEventsToIncident
script: ''
type: python
subtype: python3
tags:
- RSA NetWitness Security Analytics
comment: This command will add new events to an existing NetWitness SA incident.
system: true
args:
- name: incidentId
  required: true
  default: true
  description: '[string] Existing incident id. '
- name: eventList
  required: true
  description: '[array of strings] List of event ids separated by comma [,] must not include spaces in it. In order to get list of events you can use nw-get-events. Example: "23,12,3".'
- name: alertSummary
  required: true
  description: '[string] Short summary of the alert which will be attached to incident.'
- name: severity
  required: true
  description: '[number] Severity of the incident. Example: 50.'
- name: deviceId
  required: true
  description: '[number] The id of the device/component (Concentrator, Log Decoder, Packet Decoder, etc.) from which the events are. You can view the list of devices by executing the command nw-get-components.'
- name: incidentManagementId
  description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running nw-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
scripttarget: 0
dependson:
  must:
  - netwitness-im-add-events-to-incident
timeout: 0s
fromversion: 5.0.0
dockerimage: demisto/python3:3.12.13.10116658
tests:
- No tests (auto formatted)
skipprepare:
- script-name-incident-to-alert