Update an Intel Report

Updated 1 week ago by Elvis Hovor

Description

Updates the specified TruSTAR Intel Report. You can specify either the TruSTAR Report ID or an external tracking ID, such as a Demisto incident number. This action can only specify one Intel Report per command.

Only the fields included in the action will be updated; all others fields are left unchanged.

Format

trustar-update-report

Example

!trustar-update-report report_id=b11d4516-9935-4be7-9d6a-xxxxxxxx title="new title" 

Input

Argument

Description

Required

report_id

TruSTAR Report ID or external tracking ID

Yes

title

Title of the report

No

report-body

Text content of report

No

distribution_type

Distribution type of the report. Legal values are COMMUNITY or ENCLAVE (the default).

No

enclave_ids

Comma-separated list of Enclave IDs to search.

If no argument is specified, the default is to search all enclaves which you have Read access to in TruSTAR.

Mandatory if the distribution type is ENCLAVE.

No

external_url

URL for the external report that this originated from, if one exists. Limit 500 alphanumeric characters. Must be unique across all reports for a given company.

No

time_began

ISO-8601 formatted incident time with timezone, e.g. 2016-09-22T11:38:35+00:00.

Default is current time.

No

Output

Path

Type

Description

TruSTAR.Report.title

string

Title of the report

TruSTAR.Report.reportBody

string

Body of the report

TruSTAR.Report.id

string

ID of the report


How Did We Do?