Cyware Fusion and Threat Response

Previously, the Create Incident and Update Incident API endpoints required the UUIDs of locations, sources, assigned groups, assigned users, and business units to create or update an incident. In CFTR v3.1.3, users can also use the title of locations, sources, assigned groups, business units, and the email ID of assigned users in the API endpoints by using the values=readable_type query parameter to create or update an incident.

For example, to create an incident using the values in place of UUIDs, you can use the following API endpoint:

POST {{base_url}}/cftrapi/openapi/v1/incident/?AccessID={{open_api_access_id}}&Expires={{expires}}&Signature={{signature}}&values=readable_type
Request Parameters:
{
    "sources": "CERT",
    "assigned_group": "CFTR Admin",
    "assigned_to": "john.doe@cyware.com",
    "business_units_impacted": ["SecOps", "Field Service"],
    "locations_impacted": ["New York", "Los Angeles"]
}

Previously, the Get Incident Details and Get Asset User Details API endpoints retrieved all details except for custom fields. In CFTR v3.1.3, you can retrieve specific details of incidents and users (including custom fields) by using the field readable keys as path variables. For example, the following API endpoint retrieves the Assigned User and Labels field details of an incident:

{{base_url}}/cftrapi/openapi/v1/incident?field_readable_keys=assigned_user,labels

Previously, administrators were required to configure a time limit to reopen closed incidents. In CFTR v3.1.3, administrators can configure a time limit or allow users to reopen closed incidents anytime.

Previously, users could close an incident when all the associated actions were closed. In CFTR v3.1.3, administrators can allow users to close an incident when the associated actions are either resolved or closed.