---
title: Rsa Netwitness Siem
slug: connectors/rsa-netwitness-siem
docTags: 
createdAt: 2026-06-09T16:29:38.277Z
---

The RSA NetWitness SIEM connector enables automated interaction with the RSA NetWitness SIEM platform, facilitating incident management and alert handling.

RSA NetWitness SIEM is a powerful security information and event management platform that provides real-time visibility into your security posture. This connector enables Swimlane Turbine users to automate incident response and management, fetch detailed alert and incident data, and maintain a comprehensive security event history. By integrating with RSA NetWitness SIEM, users can streamline their security operations, enhance incident tracking, and improve overall threat detection and response times within the Swimlane ecosystem.

### Limitations

None to date.

## Prerequisites

To effectively utilize the RSA NetWitness SIEM connector with Swimlane Turbine, ensure you have the following prerequisites:

- HTTP Basic Authentication with the following parameters:
  - URL: Endpoint for RSA NetWitness SIEM API access.
  - Username: Your RSA NetWitness SIEM account username.
  - Password: Your RSA NetWitness SIEM account password.

## Capabilities

This RSA NetWitness SIEM Connector provides the following capabilities:

- Add a Journal Entry
- Fetch alerts based on the criteria
- Fetch incidents based on fields of incident
- Get Alerts by Date Range
- Get Incident Stats
- Get Incident History
- Get Incident User Stats
- Get Incidents by Date Range
- Get a Single Incident
- Get an Incident's Alerts
- Persisting events in an alert
- Persisting events in an incident
- Remove an Incident
- Suspending persist of events in an alert
- Suspending persist of events in an incident
  *... and so on*

### Add a Journal Entry

- A journal entry, or note, can be added to an existing incident.

### Fetch alerts based on the criteria

- The alerts can be fetched based on the specific fields of the alert by providing the name of the field,value of the field, the number of records and the fields of the alert that needs to be included in response.

### Fetch incidents based on fields of incident

- The incidents can be fetched based on the specific fields of the incident by providing the name ofthe field, value of the field and the number of records to be fetched as arguments.

### Get Alerts by Date Range

- Alerts can be retrieved by the date and time they were created.

### Get Incident History

- Fetch the entire history details of the incident using the incident's unique identifier.

### Get Incident Stats

- IncidentStats can be retrieved by the date and time they were created. It contains day wise detailsof the overall MTTA, MTTD and MTTR as well as the count associated with each metric for that day.

### Get Incident User Stats

- Incident User Stats can be retrieved by user and date range. It computes the MTTD values for therange of dates mentioned and responds with a consolidated list.

### Get Incidents by Date Range

- Incidents can be retrieved by the date and time they were created.

### Get a Single Incident

- A single incident can be retrieved using an incident's unique identifier.

### Get an Incident's Alerts

- All the alerts that are associated with an incident can be retrieved using the incident's uniqueidentifier.

### Persisting events in an alert

- Persist all the events present in the alert using the alert's unique identifier.

### Persisting events in an incident

- Persist all the events present in the incident using the incident's unique identifier.

### Remove an Incident

- A single incident can be removed using the incident's unique identifier.

### Suspending persist of events in an alert

- Suspend all the events present in persist alert using the alert's unique identifier.

### Suspending persist of events in an incident

- Suspend all the events present in persist incident using the incident's unique identifier.

### Update an Incident

- Currently an incident's status and assignee can be modified using the incidents endpoint.

# Configurations

## HTTP Basic Authentication

Authenticates using username and password.

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | A URL to the target host.          | string   | Required     |
| username      | Username                           | string   | Required     |
| password      | Password                           | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

# Actions

## Add a Journal Entry

Add a journal entry or note to an existing incident in RSA Netwitness SIEM using the incident's ID.

### Endpoint

- **URL:** `/rest/api/incidents/{{id}}/journal`
- **Method:** `POST`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                                                  |
| -------------------- | -------- | ------------ | ---------------------------------------------------------------- |
| `path_parameters.id` | string   | Required     | The ID of the incident to which the journal entry will be added. |
| `author`             | string   | Optional     | The NetWitness user id of the user creating the journal entry.   |
| `notes`              | string   | Optional     | Notes and observations about the incident.                       |
| `milestone`          | string   | Optional     | The incident milestone classifier.                               |

### Input Example

`{"json_body":{"author":"duke","notes":"This incident is contained.","milestone":"Containment"},"path_parameters":{"id":"INC-100"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":201,"response_headers":{},"reason":"Created","json_body":{}}`

## Fetch alerts based on the criteria

Retrieve RSA Netwitness SIEM alerts filtered by field names, values, record count, and specified response fields.

### Endpoint

- **URL:** `/rest/api/alert/fetch`
- **Method:** `GET`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                                                                                                        |
| ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `meta_name`       | string   | Optional     | Field of the alert document based on which the incident query to be made.                                                                              |
| `meta_value`      | string   | Optional     | Value for the field of the alert document based on which the incident query to be made.                                                                |
| `numberOfRecords` | string   | Optional     | Number of alert records to be fetched for the selected meta\_key and meta\_value pair. Max 1000.                                                       |
| `includeFields`   | string   | Optional     | The fields from the alert mongo document to be included in the output, if fetching the entire alert is not preferred (Comma separated list of fields). |

### Input Example

`{"json_body":{"meta_name":"alert.source","meta_value":"Event Stream Analysis","numberOfRecords":"1","includeFields":"null"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`[]`

## Fetch incidents based on fields of incident

Retrieve RSA Netwitness SIEM incidents filtered by specific field values and control the number of records fetched.

### Endpoint

- **URL:** `/rest/api/incident/fetch`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                             |
| ----------------- | -------- | ------------ | ------------------------------------------- |
| `meta_name`       | string   | Optional     | The name of the field to filter incidents.  |
| `meta_value`      | string   | Optional     | The value of the field to filter incidents. |
| `numberOfRecords` | string   | Optional     | The number of records to fetch.             |

### Input Example

`{"json_body":{"meta_name":"priority","meta_value":"MEDIUM","numberOfRecords":"1"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"id":"INC-75831","name":"High Risk Alerts: ESA-Packet for 30.0","summary":"","priority":"MEDIUM","prioritySort":1,"riskScore":30,"status":"ASSIGNED","statusSort":1,"alertCount":7,"pinnedAlertCount":0,"containsPinnedAlerts":false,"averageAlertRiskScore":30,"sealed":true,"totalRemediationTaskCount":0,"openRemediationTaskCount":0}]}`

## Get a Single Incident

Retrieve a specific incident from RSA NetWitness SIEM using the unique incident identifier.

### Endpoint

- **URL:** `/rest/api/incidents/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                        |
| -------------------- | -------- | ------------ | -------------------------------------- |
| `path_parameters.id` | string   | Required     | The unique identifier of the incident. |

### Input Example

`{"path_parameters":{"id":"INC-100"}}`

### Output

| **Parameter**               | **Type** | **Description**                  |
| --------------------------- | -------- | -------------------------------- |
| `status_code`               | number   | HTTP status code of the response |
| `reason`                    | string   | Response reason phrase           |
| `id`                        | string   | Unique identifier                |
| `title`                     | string   | Output field: title              |
| `summary`                   | string   | Output field: summary            |
| `priority`                  | string   | Output field: priority           |
| `riskScore`                 | number   | Score value                      |
| `status`                    | string   | Status value                     |
| `alertCount`                | number   | Count value                      |
| `averageAlertRiskScore`     | number   | Score value                      |
| `sealed`                    | boolean  | Output field: sealed             |
| `totalRemediationTaskCount` | number   | Count value                      |
| `openRemediationTaskCount`  | number   | Count value                      |
| `created`                   | string   | Output field: created            |
| `lastUpdated`               | string   | Output field: lastUpdated        |
| `lastUpdatedBy`             | string   | Output field: lastUpdatedBy      |
| `assignee`                  | string   | Output field: assignee           |
| `sources`                   | array    | Output field: sources            |
| `ruleId`                    | string   | Unique identifier                |
| `firstAlertTime`            | string   | Time value                       |
| `categories`                | array    | Output field: categories         |
| `categories.id`             | string   | Unique identifier                |
| `categories.parent`         | string   | Output field: categories.parent  |
| `categories.name`           | string   | Name of the resource             |
| `journalEntries`            | array    | Output field: journalEntries     |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"INC-100","title":"Suspected C&C with suspicious-domain.com","summary":"Security Analytics detected communications with suspicious-domain.com that may b...","priority":"Critical","riskScore":100,"status":"InProgress","alertCount":1,"averageAlertRiskScore":100,"sealed":true,"totalRemediationTaskCount":4,"openRemediationTaskCount":5,"created":"2018-01-01T04:49:27.870Z","lastUpdated":"2024-02-06T12:44:34.722Z","lastUpdatedBy":...`

## Get Alerts by Date Range

Retrieve alerts from RSA Netwitness SIEM based on a specified date and time range.

### Endpoint

- **URL:** `/rest/api/alerts`
- **Method:** `GET`

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                                                                            |
| ----------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------ |
| `parameters.pageNumber` | number   | Optional     | The page number for pagination.                                                            |
| `parameters.pageSize`   | number   | Optional     | The number of items per page for pagination.                                               |
| `parameters.since`      | string   | Optional     | A date format (e.g., 2022-01-01). Retrieve incidents stats created on and after this date. |
| `parameters.until`      | string   | Optional     | A date format (e.g., 2022-01-31). Retrieve incident stats created on and before this date. |

### Input Example

`{"parameters":{"pageNumber":0,"pageSize":100,"since":"2022-01-01","until":"2022-01-31"}}`

### Output

| **Parameter**                         | **Type** | **Description**                                    |
| ------------------------------------- | -------- | -------------------------------------------------- |
| `status_code`                         | number   | HTTP status code of the response                   |
| `reason`                              | string   | Response reason phrase                             |
| `items`                               | array    | Output field: items                                |
| `items.id`                            | string   | Unique identifier                                  |
| `items.receivedTime`                  | string   | Time value                                         |
| `items.status`                        | string   | Status value                                       |
| `items.errorMessage`                  | object   | Response message                                   |
| `items.originalHeaders`               | object   | HTTP headers for the request                       |
| `items.originalHeaders.name`          | string   | HTTP headers for the request                       |
| `items.originalHeaders.description`   | string   | HTTP headers for the request                       |
| `items.originalHeaders.version`       | number   | HTTP headers for the request                       |
| `items.originalHeaders.severity`      | number   | HTTP headers for the request                       |
| `items.originalHeaders.timestamp`     | number   | HTTP headers for the request                       |
| `items.originalHeaders.signatureId`   | string   | HTTP headers for the request                       |
| `items.originalHeaders.deviceVendor`  | string   | HTTP headers for the request                       |
| `items.originalHeaders.deviceProduct` | string   | HTTP headers for the request                       |
| `items.originalRawAlert`              | object   | Output field: items.originalRawAlert               |
| `items.originalAlert`                 | object   | Output field: items.originalAlert                  |
| `items.originalAlert.severity`        | number   | Output field: items.originalAlert.severity         |
| `items.originalAlert.dataSourceHost`  | string   | Response data                                      |
| `items.originalAlert.user_summary`    | string   | Output field: items.originalAlert.user\_summary    |
| `items.originalAlert.events`          | array    | Output field: items.originalAlert.events           |
| `items.originalAlert.events.ip_proto` | number   | Output field: items.originalAlert.events.ip\_proto |
| `items.originalAlert.events.ip_src`   | string   | Output field: items.originalAlert.events.ip\_src   |
| `items.originalAlert.events.lifetime` | number   | Time value                                         |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"pageNumber":0,"pageSize":100,"totalPages":1,"totalItems":1,"hasNext":false,"hasPrevious":false}}`

## Get an Incident's Alerts

Retrieve all alerts associated with a specific incident in RSA Netwitness SIEM using the incident's unique identifier.

### Endpoint

- **URL:** `/rest/api/incidents/{{id}}/alerts`
- **Method:** `GET`

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                                              |
| ----------------------- | -------- | ------------ | ------------------------------------------------------------ |
| `parameters.pageNumber` | number   | Optional     | The page number to retrieve.                                 |
| `parameters.pageSize`   | number   | Optional     | The number of items to retrieve per page.                    |
| `path_parameters.id`    | string   | Required     | The ID of the incident for which alerts are being retrieved. |

### Input Example

`{"parameters":{"pageNumber":0,"pageSize":100},"path_parameters":{"id":"INC-100"}}`

### Output

| **Parameter**                            | **Type** | **Description**                                     |
| ---------------------------------------- | -------- | --------------------------------------------------- |
| `status_code`                            | number   | HTTP status code of the response                    |
| `reason`                                 | string   | Response reason phrase                              |
| `items`                                  | array    | Output field: items                                 |
| `items.id`                               | string   | Unique identifier                                   |
| `items.title`                            | string   | Output field: items.title                           |
| `items.detail`                           | string   | Output field: items.detail                          |
| `items.created`                          | string   | Output field: items.created                         |
| `items.source`                           | string   | Output field: items.source                          |
| `items.riskScore`                        | number   | Score value                                         |
| `items.type`                             | string   | Type of the resource                                |
| `items.events`                           | array    | Output field: items.events                          |
| `items.events.source`                    | object   | Output field: items.events.source                   |
| `items.events.source.device`             | object   | Output field: items.events.source.device            |
| `items.events.source.device.ipAddress`   | string   | Output field: items.events.source.device.ipAddress  |
| `items.events.source.device.port`        | number   | Output field: items.events.source.device.port       |
| `items.events.source.device.macAddress`  | string   | Output field: items.events.source.device.macAddress |
| `items.events.source.device.dnsHostname` | object   | Name of the resource                                |
| `items.events.source.device.dnsDomain`   | object   | Output field: items.events.source.device.dnsDomain  |
| `items.events.source.user`               | object   | Output field: items.events.source.user              |
| `items.events.source.user.username`      | string   | Name of the resource                                |
| `items.events.source.user.emailAddress`  | object   | Output field: items.events.source.user.emailAddress |
| `items.events.source.user.adUsername`    | object   | Name of the resource                                |
| `items.events.source.user.adDomain`      | object   | Output field: items.events.source.user.adDomain     |
| `items.events.destination`               | object   | Output field: items.events.destination              |
| `items.events.destination.device`        | object   | Output field: items.events.destination.device       |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"pageNumber":0,"pageSize":10,"totalPages":1,"totalItems":1,"hasNext":false,"hasPrevious":false}}`

## Get Incident history

Retrieve the complete history of an incident in RSA NetWitness SIEM using the unique incident identifier.

### Endpoint

- **URL:** `/rest/api/incidents/history/{{id}}`
- **Method:** `POST`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                              |
| -------------------- | -------- | ------------ | -------------------------------------------- |
| `path_parameters.id` | string   | Required     | The ID of the incident to fetch history for. |

### Input Example

`{"path_parameters":{"id":"INC-100"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"type":"STATUS","date":"2022-05-11T09:24:43.025+00:00","changedBy":"admin","changedFrom":"IN_PROGRESS","changedTo":"REMEDIATION_REQUESTED"},{"type":"PRIORITY","date":"2022-05-11T09:25:18.767+00:00","changedBy":"admin","changedFrom":"HIGH","changedTo":"MEDIUM"},{"type":"ASSIGNEE","date":"2022-05-11T09:25:31.157+00:00","changedBy":"admin","changedFrom":"rolden","changedTo":"admin"}]}`

## Get Incident Stats

Retrieve day-wise incident statistics from RSA Netwitness SIEM, including MTTA, MTTD, MTTR, and associated counts.

### Endpoint

- **URL:** `/rest/api/incidents/stats`
- **Method:** `GET`

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                                                                                                           |
| ----------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------- |
| `parameters.pageNumber` | number   | Optional     | The requested page number.                                                                                                |
| `parameters.pageSize`   | number   | Optional     | The maximum number of items to return in a single page.                                                                   |
| `parameters.since`      | string   | Optional     | A timestamp in ISO 8601 format (e.g., 2018-01-01T14:00:00.000Z). Retrieve incidents created on and after this timestamp.  |
| `parameters.until`      | string   | Optional     | A timestamp in ISO 8601 format (e.g., 2018-01-01T14:00:00.000Z). Retrieve incidents created on and before this timestamp. |

### Input Example

`{"parameters":{"pageNumber":0,"pageSize":100,"since":"2018-01-01T14:00:00.000Z","until":"2018-01-01T14:00:00.000Z"}}`

### Output

| **Parameter**     | **Type** | **Description**                  |
| ----------------- | -------- | -------------------------------- |
| `status_code`     | number   | HTTP status code of the response |
| `reason`          | string   | Response reason phrase           |
| `items`           | array    | Output field: items              |
| `items.date`      | string   | Date value                       |
| `items.mtta`      | number   | Output field: items.mtta         |
| `items.mttaCount` | number   | Count value                      |
| `items.mttd`      | number   | Output field: items.mttd         |
| `items.mttdCount` | number   | Count value                      |
| `items.mttr`      | number   | Output field: items.mttr         |
| `items.mttrCount` | number   | Count value                      |
| `pageNumber`      | number   | Output field: pageNumber         |
| `pageSize`        | number   | Output field: pageSize           |
| `totalPages`      | number   | Output field: totalPages         |
| `totalItems`      | number   | Output field: totalItems         |
| `hasNext`         | boolean  | Output field: hasNext            |
| `hasPrevious`     | boolean  | Output field: hasPrevious        |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"pageNumber":0,"pageSize":100,"totalPages":1,"totalItems":1,"hasNext":false,"hasPrevious":false}}`

## Get Incident User Stats

Retrieve user-specific incident statistics and Mean Time To Detect (MTTD) values for a specified date range in RSA Netwitness SIEM.

### Endpoint

- **URL:** `/rest/api/incidents/user-stats`
- **Method:** `GET`

### Input

| **Argument Name**     | **Type** | **Required** | **Description**                                                                             |
| --------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------- |
| `parameters.username` | string   | Optional     | The NetWitness user id of the user for whom the stats are being requested.                  |
| `parameters.since`    | string   | Optional     | A date format (e.g., 2022-01-01). Retrieve incidents stats created on and after this date.  |
| `parameters.until`    | string   | Optional     | A date format (e.g., 2022-01-31). Retrieve incidents stats created on and before this date. |

### Input Example

`{"parameters":{"username":"admin","since":"2022-01-01","until":"2022-01-31"}}`

### Output

| **Parameter**        | **Type** | **Description**                  |
| -------------------- | -------- | -------------------------------- |
| `status_code`        | number   | HTTP status code of the response |
| `reason`             | string   | Response reason phrase           |
| `userName`           | string   | Name of the resource             |
| `overallClosedCount` | number   | Count value                      |
| `mttd`               | number   | Output field: mttd               |
| `mttdCount`          | number   | Count value                      |
| `incidentIds`        | array    | Unique identifier                |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"userName":"admin","overallClosedCount":2,"mttd":12,"mttdCount":2,"incidentIds":["INC-1","INC-2"]}}`

## Get Incidents by Date Range

Retrieve incidents from RSA NetWitness SIEM based on the specified creation date and time range.

### Endpoint

- **URL:** `/rest/api/incidents`
- **Method:** `GET`

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                                                                                                           |
| ----------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------- |
| `parameters.pageNumber` | number   | Optional     | The requested page number.                                                                                                |
| `parameters.pageSize`   | number   | Optional     | The maximum number of items to return in a single page.                                                                   |
| `parameters.since`      | string   | Optional     | A timestamp in ISO 8601 format (e.g., 2018-01-01T14:00:00.000Z). Retrieve incidents created on and after this timestamp.  |
| `parameters.until`      | string   | Optional     | A timestamp in ISO 8601 format (e.g., 2018-01-01T14:00:00.000Z). Retrieve incidents created on and before this timestamp. |

### Input Example

`{"parameters":{"pageNumber":0,"pageSize":100,"since":"2018-01-01T14:00:00.000Z","until":"2018-01-01T14:00:00.000Z"}}`

### Output

| **Parameter**                     | **Type** | **Description**                       |
| --------------------------------- | -------- | ------------------------------------- |
| `status_code`                     | number   | HTTP status code of the response      |
| `reason`                          | string   | Response reason phrase                |
| `items`                           | array    | Output field: items                   |
| `items.id`                        | string   | Unique identifier                     |
| `items.title`                     | string   | Output field: items.title             |
| `items.summary`                   | string   | Output field: items.summary           |
| `items.priority`                  | string   | Output field: items.priority          |
| `items.riskScore`                 | number   | Score value                           |
| `items.status`                    | string   | Status value                          |
| `items.alertCount`                | number   | Count value                           |
| `items.averageAlertRiskScore`     | number   | Score value                           |
| `items.sealed`                    | boolean  | Output field: items.sealed            |
| `items.totalRemediationTaskCount` | number   | Count value                           |
| `items.openRemediationTaskCount`  | number   | Count value                           |
| `items.created`                   | string   | Output field: items.created           |
| `items.lastUpdated`               | string   | Output field: items.lastUpdated       |
| `items.lastUpdatedBy`             | string   | Output field: items.lastUpdatedBy     |
| `items.assignee`                  | string   | Output field: items.assignee          |
| `items.sources`                   | array    | Output field: items.sources           |
| `items.ruleId`                    | string   | Unique identifier                     |
| `items.firstAlertTime`            | string   | Time value                            |
| `items.categories`                | array    | Output field: items.categories        |
| `items.categories.id`             | string   | Unique identifier                     |
| `items.categories.parent`         | string   | Output field: items.categories.parent |
| `items.categories.name`           | string   | Name of the resource                  |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items":[{}],"pageNumber":0,"pageSize":100,"totalPages":1,"totalItems":1,"hasNext":false,"hasPrevious":false}}`

## Persisting events in an alert

Persist all events in an alert identified by a unique ID within RSA Netwitness SIEM.

### Endpoint

- **URL:** `/rest/api/alerts/persist/{{id}}`
- **Method:** `POST`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                           |
| -------------------- | -------- | ------------ | ----------------------------------------- |
| `path_parameters.id` | string   | Required     | The ID of the alert to persist events in. |

### Input Example

`{"json_body":{},"path_parameters":{"id":"59440ad7e4b0ff674d2cd85e"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `status`      | string   | Status value                     |
| `message`     | string   | Response message                 |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"SUCCESS","message":"Persisted alert id 59440ad7e4b0ff674d2cd85e"}}`

## Persisting events in an incident

Permanently store all events associated with a specific incident in RSA Netwitness SIEM using the incident's unique ID.

### Endpoint

- **URL:** `/rest/api/incidents/persist/{{id}}`
- **Method:** `POST`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                              |
| -------------------- | -------- | ------------ | -------------------------------------------- |
| `path_parameters.id` | string   | Required     | The ID of the incident to persist events in. |

### Input Example

`{"path_parameters":{"id":"INC-100"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `status`      | string   | Status value                     |
| `message`     | string   | Response message                 |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"SUCCESS","message":"Task successfully submitted to persist incident id - INC-75287"}}`

## Remove an Incident

Removes a specified incident from RSA NetWitness SIEM using the unique incident identifier.

### Endpoint

- **URL:** `/rest/api/incidents/{{id}}`
- **Method:** `DELETE`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                   |
| -------------------- | -------- | ------------ | --------------------------------- |
| `path_parameters.id` | string   | Required     | The ID of the incident to remove. |

### Input Example

`{"path_parameters":{"id":"INC-100"}}`

### Output

| **Parameter**   | **Type** | **Description**                  |
| --------------- | -------- | -------------------------------- |
| `status_code`   | number   | HTTP status code of the response |
| `reason`        | string   | Response reason phrase           |
| `response_text` | string   | Output field: response\_text     |

### Output Example

`{"status_code":204,"response_headers":{},"reason":"No Content","response_text":""}`

## Suspending persist of events in an alert

Suspend all events within a persistent alert on RSA Netwitness SIEM using the alert's unique ID.

### Endpoint

- **URL:** `/rest/api/alerts/suspend-persist/{{id}}`
- **Method:** `POST`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                                   |
| -------------------- | -------- | ------------ | ------------------------------------------------- |
| `path_parameters.id` | string   | Required     | The ID of the alert to suspend persist events in. |

### Input Example

`{"path_parameters":{"id":"59440ad7e4b0ff674d2cd85e"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `status`      | string   | Status value                     |
| `message`     | string   | Response message                 |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"SUCCESS","message":"Suspended persist for alert id 59440ad7e4b0ff674d2cd85e"}}`

## Suspending persist of events in an incident

Suspend all events within a persistent incident in RSA Netwitness SIEM using the incident's unique ID.

### Endpoint

- **URL:** `/rest/api/incidents/suspend-persist/{{id}}`
- **Method:** `POST`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                         |
| -------------------- | -------- | ------------ | --------------------------------------- |
| `path_parameters.id` | string   | Required     | The unique identifier for the incident. |

### Input Example

`{"path_parameters":{"id":"INC-75287"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `status`      | string   | Status value                     |
| `message`     | string   | Response message                 |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"SUCCESS","message":"Suspended persist for incident id INC-75287"}}`

## Update an Incident

Modify an incident's status in RSA Netwitness SIEM using the incident ID and status provided in the JSON body.

### Endpoint

- **URL:** `/rest/api/incidents/{{id}}`
- **Method:** `PATCH`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                    |
| -------------------- | -------- | ------------ | ---------------------------------- |
| `path_parameters.id` | string   | Required     | The ID of the incident to update.  |
| `status`             | string   | Optional     | The new status of the incident.    |
| `assignee`           | string   | Optional     | The new assignee for the incident. |

### Input Example

`{"json_body":{"status":"InProgress","assignee":"tony"},"path_parameters":{"id":"INC-100"}}`

### Output

| **Parameter**               | **Type** | **Description**                  |
| --------------------------- | -------- | -------------------------------- |
| `status_code`               | number   | HTTP status code of the response |
| `reason`                    | string   | Response reason phrase           |
| `id`                        | string   | Unique identifier                |
| `title`                     | string   | Output field: title              |
| `summary`                   | string   | Output field: summary            |
| `priority`                  | string   | Output field: priority           |
| `riskScore`                 | number   | Score value                      |
| `status`                    | string   | Status value                     |
| `alertCount`                | number   | Count value                      |
| `averageAlertRiskScore`     | number   | Score value                      |
| `sealed`                    | boolean  | Output field: sealed             |
| `totalRemediationTaskCount` | number   | Count value                      |
| `openRemediationTaskCount`  | number   | Count value                      |
| `created`                   | string   | Output field: created            |
| `lastUpdated`               | string   | Output field: lastUpdated        |
| `lastUpdatedBy`             | string   | Output field: lastUpdatedBy      |
| `assignee`                  | string   | Output field: assignee           |
| `sources`                   | array    | Output field: sources            |
| `ruleId`                    | string   | Unique identifier                |
| `firstAlertTime`            | string   | Time value                       |
| `categories`                | array    | Output field: categories         |
| `categories.id`             | string   | Unique identifier                |
| `categories.parent`         | string   | Output field: categories.parent  |
| `categories.name`           | string   | Name of the resource             |
| `journalEntries`            | array    | Output field: journalEntries     |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"INC-100","title":"Suspected C&C with suspicious-domain.com","summary":"Security Analytics detected communications with suspicious-domain.com that may b...","priority":"Critical","riskScore":100,"status":"InProgress","alertCount":1,"averageAlertRiskScore":100,"sealed":true,"totalRemediationTaskCount":4,"openRemediationTaskCount":5,"created":"2018-01-01T04:49:27.870Z","lastUpdated":"2024-02-06T12:44:34.020Z","lastUpdatedBy":...`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |