Important Update: Community URLs redirect issues are partially resolved. Learn More. .

cancel
Showing results for 
Search instead for 
Did you mean: 

Creating a Cyber Security Incident Record through API

ghostrider9899
Contributor II

ghostrider9899_0-1710537845004.png

Hi All,

I am trying to create a Security Incident New Record that is shown above by API Call. I have no idea from the docs where to start and how to get this working. I got a few API calls working. I have the authentication working but i don't even know what POST url and payload to run to create a "record" essentially as shown above.

Dan

 

2 ACCEPTED SOLUTIONS

Accepted Solutions

For the web services (SOAP) API (POST), [URL]/ws/record.asmx

For the REST APIs (POST), [URL]/platformapi/core/content

 Advisory Consultant

View solution in original post

That's determined by module/application id (SOAP) or level id (REST).

 Advisory Consultant

View solution in original post

7 REPLIES 7

MargoBrosnan
Advocate

You'll need to use the SOAP action http://archer-tech.com/webservices/CreateRecords

I typically use a mix of SOAP and REST calls.  Initially the API was SOAP, and that's where most of the data manipulation happens.  REST has newer functions to retrieve meta-data, user information, advanced workflow calls, etc..  After you establish the SOAP connection, create a REST connection but send it the session ID from the SOAP call.  Then you can use both without invalidating the session token.

The API resources available in the administration list under Integration are very helpful for finding which calls you need.  You can also download the API documentation PDFs (again, you'll want both the original "web services API" and the "REST API" documents).   Does anyone have current links for these?  I'm only seeing links that go back to the RSA site.  Thanks.

ghostrider9899
Contributor II

what would be the request url to create a ticket in Security Incidents Record. I am trying to figure that part out.

For the web services (SOAP) API (POST), [URL]/ws/record.asmx

For the REST APIs (POST), [URL]/platformapi/core/content

 Advisory Consultant

Sorry I am trying to figure out how to label under Cyber Security Incident vs a Finding. Thats where alot of my confusion lies.

That's determined by module/application id (SOAP) or level id (REST).

 Advisory Consultant

ghostrider9899
Contributor II

/platformapi/core/content/Findings, would that be uri path i would POST too?

ghostrider9899
Contributor II

oh ok i see?