BLblinkops
Case Management

Create a Case

Adds a new Case record.

post/workspace/{ws_id}/case_management/table/cases

Request

  • Base URL
    https://your-tenant.app.blinkops.com/api/v1
  • URL
    https://your-tenant.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases
  • Auth
    API key in header BLINK-API-KEY

Path parameters

ws_idstring required

Workspace ID

Request body */*

case_managerstring[]
case_tagsstring[]
mitre_attackstring[]
namestring
overviewstring
severityinteger
slainteger
sla_expiryinteger
status'OPEN' | 'IN PROGRESS' | 'CLOSED'
summarystring
type'Malware' | 'Ransomware' | 'Adware' | 'Spyware' | 'Crypto Miner' | 'Data Exfiltration' | 'Insider Threat' | 'Network Intrusion' | 'DoS' | 'DDoS' | 'MITM' | 'SQL Injection' | 'Email Spoofing' | 'DNS Spoofing' | 'C2 Communications' | 'Rogue Device' | 'Brute Force' | 'Phishing' | 'Compromised Credentials' | 'Account Takeover' | 'Physical' | 'Vulnerability' | 'Reconnaissance' | 'Domain Takeover' | 'Lateral Movement' | 'Network Exposure' | 'Data Exposure' | 'Credential Exposure' | 'Suspicious User Activity' | 'Suspicious Login' | 'Suspicious Network Activity' | 'Suspicious USB Device' | 'Security Policy Violation' | 'Security Compliance Violation'
vendorsstring[]

Example request

{
  "case_manager": [
    "john.doe@blinkops.com"
  ],
  "case_tags": [
    "Malware",
    "Ransomware",
    "Insider Threat"
  ],
  "mitre_attack": [
    "Reconnaissance",
    "Resource Development"
  ],
  "name": "New Case",
  "overview": "<p>1. New Malware detected</p>",
  "severity": 3,
  "sla": 259200000,
  "sla_expiry": 60000,
  "status": "OPEN",
  "summary": "Summary of the case",
  "type": "Malware",
  "vendors": [
    "CrowdStrike"
  ]
}

Response

OK

case_managerstring[]
case_tagsstring[]
mitre_attackstring[]
namestring
overviewstring
severityinteger
slainteger
sla_expiryinteger
status'OPEN' | 'IN PROGRESS' | 'CLOSED'
summarystring
type'Malware' | 'Ransomware' | 'Adware' | 'Spyware' | 'Crypto Miner' | 'Data Exfiltration' | 'Insider Threat' | 'Network Intrusion' | 'DoS' | 'DDoS' | 'MITM' | 'SQL Injection' | 'Email Spoofing' | 'DNS Spoofing' | 'C2 Communications' | 'Rogue Device' | 'Brute Force' | 'Phishing' | 'Compromised Credentials' | 'Account Takeover' | 'Physical' | 'Vulnerability' | 'Reconnaissance' | 'Domain Takeover' | 'Lateral Movement' | 'Network Exposure' | 'Data Exposure' | 'Credential Exposure' | 'Suspicious User Activity' | 'Suspicious Login' | 'Suspicious Network Activity' | 'Suspicious USB Device' | 'Security Policy Violation' | 'Security Compliance Violation'
vendorsstring[]

Example response

{
  "case_manager": [
    "john.doe@blinkops.com"
  ],
  "case_tags": [
    "Malware",
    "Ransomware",
    "Insider Threat"
  ],
  "mitre_attack": [
    "Reconnaissance",
    "Resource Development"
  ],
  "name": "New Case",
  "overview": "<p>1. New Malware detected</p>",
  "severity": 3,
  "sla": 259200000,
  "sla_expiry": 60000,
  "status": "OPEN",
  "summary": "Summary of the case",
  "type": "Malware",
  "vendors": [
    "CrowdStrike"
  ]
}

Changes

No recorded changes to this operation across all 2 revisions of this API.