Create Related Info To Case Soar icon

Create Related Info To Case Soar

Create Related Info To Case Soar

Create Related Info To Case Soar

AI-generated

Overview

This node creates related information entries linked to a specific case in a SOAR (Security Orchestration, Automation, and Response) system. It is useful for enriching cases with additional context such as indicators, groups, or victims, which helps in incident investigation and response. For example, a user can add an IP address indicator or a malware group related to a case to enhance the case details.

Use Case Examples

  1. Adding an IP address indicator to a case to track suspicious network activity.
  2. Linking a malware group to a case to associate known threats with the investigation.
  3. Adding a victim account to a case to document affected entities.

Properties

Name Meaning
Case Code The unique identifier of the case to which the related information will be added.
Type The category of the related information, which can be INDICATOR, GROUP, or VICTIM.
Sub Type The specific subtype of the related information, dependent on the selected Type. For INDICATOR, options include DOMAIN, EMAIL, HASH, IP, URL; for GROUP, options include CAMPAIGN, MALWARE, THREAT_ACTOR; for VICTIM, options include ACCOUNT, COMPUTER, WEBSITE.
Value The actual value of the related information to be added to the case.
Tenancy Code Optional tenancy code associated with the case.

Output

JSON

  • success - Indicates whether the related info creation was successful.
  • response - The response data returned from the SOAR API after creating the related info.
  • caseCode - The case code to which the related info was added.
  • error - Error message if the creation failed.
  • statusCode - HTTP status code returned on error.
  • caseName - The case name parameter used in error logging (if applicable).

Dependencies

  • An API key credential for the SOAR system (referred to as 'soarApi' credential) providing the API URL and token for authentication.

Troubleshooting

  • Common issues include invalid or missing API credentials, resulting in authentication errors.
  • Incorrect or missing required parameters such as caseCode, type, subType, or value can cause the API request to fail.
  • Network or connectivity issues to the SOAR API endpoint may cause request failures.
  • Error messages include HTTP status codes and response bodies from the SOAR API, which help diagnose issues.
  • If the node is set to continue on fail, it will output error details instead of stopping execution.

Discussion