Create a Case
curl --request POST \
--url https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases \
--header 'BLINK-API-KEY: <api-key>' \
--header 'Content-Type: */*' \
--data '
{
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
}
'import requests
url = "https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases"
payload = {
"case_manager": ["john.doe@blinkops.com"],
"case_tags": ["Malware", "Ransomware", "Insider Threat"],
"mitre_attack": ["Reconnaissance", "Resource Development"],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": ["CrowdStrike"]
}
headers = {
"BLINK-API-KEY": "<api-key>",
"Content-Type": "*/*"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'BLINK-API-KEY': '<api-key>', 'Content-Type': '*/*'},
body: JSON.stringify({
case_manager: ['john.doe@blinkops.com'],
case_tags: ['Malware', 'Ransomware', 'Insider Threat'],
mitre_attack: ['Reconnaissance', 'Resource Development'],
name: 'New Case',
overview: '<p>1. New Malware detected</p>',
severity: 3,
sla: 259200000,
sla_expiry: 60000,
status: 'OPEN',
summary: 'Summary of the case',
type: 'Malware',
vendors: ['CrowdStrike']
})
};
fetch('https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'case_manager' => [
'john.doe@blinkops.com'
],
'case_tags' => [
'Malware',
'Ransomware',
'Insider Threat'
],
'mitre_attack' => [
'Reconnaissance',
'Resource Development'
],
'name' => 'New Case',
'overview' => '<p>1. New Malware detected</p>',
'severity' => 3,
'sla' => 259200000,
'sla_expiry' => 60000,
'status' => 'OPEN',
'summary' => 'Summary of the case',
'type' => 'Malware',
'vendors' => [
'CrowdStrike'
]
]),
CURLOPT_HTTPHEADER => [
"BLINK-API-KEY: <api-key>",
"Content-Type: */*"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases"
payload := strings.NewReader("{\n \"case_manager\": [\n \"john.doe@blinkops.com\"\n ],\n \"case_tags\": [\n \"Malware\",\n \"Ransomware\",\n \"Insider Threat\"\n ],\n \"mitre_attack\": [\n \"Reconnaissance\",\n \"Resource Development\"\n ],\n \"name\": \"New Case\",\n \"overview\": \"<p>1. New Malware detected</p>\",\n \"severity\": 3,\n \"sla\": 259200000,\n \"sla_expiry\": 60000,\n \"status\": \"OPEN\",\n \"summary\": \"Summary of the case\",\n \"type\": \"Malware\",\n \"vendors\": [\n \"CrowdStrike\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("BLINK-API-KEY", "<api-key>")
req.Header.Add("Content-Type", "*/*")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases")
.header("BLINK-API-KEY", "<api-key>")
.header("Content-Type", "*/*")
.body("{\n \"case_manager\": [\n \"john.doe@blinkops.com\"\n ],\n \"case_tags\": [\n \"Malware\",\n \"Ransomware\",\n \"Insider Threat\"\n ],\n \"mitre_attack\": [\n \"Reconnaissance\",\n \"Resource Development\"\n ],\n \"name\": \"New Case\",\n \"overview\": \"<p>1. New Malware detected</p>\",\n \"severity\": 3,\n \"sla\": 259200000,\n \"sla_expiry\": 60000,\n \"status\": \"OPEN\",\n \"summary\": \"Summary of the case\",\n \"type\": \"Malware\",\n \"vendors\": [\n \"CrowdStrike\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["BLINK-API-KEY"] = '<api-key>'
request["Content-Type"] = '*/*'
request.body = "{\n \"case_manager\": [\n \"john.doe@blinkops.com\"\n ],\n \"case_tags\": [\n \"Malware\",\n \"Ransomware\",\n \"Insider Threat\"\n ],\n \"mitre_attack\": [\n \"Reconnaissance\",\n \"Resource Development\"\n ],\n \"name\": \"New Case\",\n \"overview\": \"<p>1. New Malware detected</p>\",\n \"severity\": 3,\n \"sla\": 259200000,\n \"sla_expiry\": 60000,\n \"status\": \"OPEN\",\n \"summary\": \"Summary of the case\",\n \"type\": \"Malware\",\n \"vendors\": [\n \"CrowdStrike\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
}{
"data": {},
"details": "<string>",
"identifier": "<string>",
"message": "<string>",
"status": 404,
"user_error": {}
}Case Management
Create a Case
API endpoint to create a new case in Blink’s case management system.
POST
/
workspace
/
{ws_id}
/
case_management
/
table
/
cases
Create a Case
curl --request POST \
--url https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases \
--header 'BLINK-API-KEY: <api-key>' \
--header 'Content-Type: */*' \
--data '
{
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
}
'import requests
url = "https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases"
payload = {
"case_manager": ["john.doe@blinkops.com"],
"case_tags": ["Malware", "Ransomware", "Insider Threat"],
"mitre_attack": ["Reconnaissance", "Resource Development"],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": ["CrowdStrike"]
}
headers = {
"BLINK-API-KEY": "<api-key>",
"Content-Type": "*/*"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'BLINK-API-KEY': '<api-key>', 'Content-Type': '*/*'},
body: JSON.stringify({
case_manager: ['john.doe@blinkops.com'],
case_tags: ['Malware', 'Ransomware', 'Insider Threat'],
mitre_attack: ['Reconnaissance', 'Resource Development'],
name: 'New Case',
overview: '<p>1. New Malware detected</p>',
severity: 3,
sla: 259200000,
sla_expiry: 60000,
status: 'OPEN',
summary: 'Summary of the case',
type: 'Malware',
vendors: ['CrowdStrike']
})
};
fetch('https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'case_manager' => [
'john.doe@blinkops.com'
],
'case_tags' => [
'Malware',
'Ransomware',
'Insider Threat'
],
'mitre_attack' => [
'Reconnaissance',
'Resource Development'
],
'name' => 'New Case',
'overview' => '<p>1. New Malware detected</p>',
'severity' => 3,
'sla' => 259200000,
'sla_expiry' => 60000,
'status' => 'OPEN',
'summary' => 'Summary of the case',
'type' => 'Malware',
'vendors' => [
'CrowdStrike'
]
]),
CURLOPT_HTTPHEADER => [
"BLINK-API-KEY: <api-key>",
"Content-Type: */*"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases"
payload := strings.NewReader("{\n \"case_manager\": [\n \"john.doe@blinkops.com\"\n ],\n \"case_tags\": [\n \"Malware\",\n \"Ransomware\",\n \"Insider Threat\"\n ],\n \"mitre_attack\": [\n \"Reconnaissance\",\n \"Resource Development\"\n ],\n \"name\": \"New Case\",\n \"overview\": \"<p>1. New Malware detected</p>\",\n \"severity\": 3,\n \"sla\": 259200000,\n \"sla_expiry\": 60000,\n \"status\": \"OPEN\",\n \"summary\": \"Summary of the case\",\n \"type\": \"Malware\",\n \"vendors\": [\n \"CrowdStrike\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("BLINK-API-KEY", "<api-key>")
req.Header.Add("Content-Type", "*/*")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases")
.header("BLINK-API-KEY", "<api-key>")
.header("Content-Type", "*/*")
.body("{\n \"case_manager\": [\n \"john.doe@blinkops.com\"\n ],\n \"case_tags\": [\n \"Malware\",\n \"Ransomware\",\n \"Insider Threat\"\n ],\n \"mitre_attack\": [\n \"Reconnaissance\",\n \"Resource Development\"\n ],\n \"name\": \"New Case\",\n \"overview\": \"<p>1. New Malware detected</p>\",\n \"severity\": 3,\n \"sla\": 259200000,\n \"sla_expiry\": 60000,\n \"status\": \"OPEN\",\n \"summary\": \"Summary of the case\",\n \"type\": \"Malware\",\n \"vendors\": [\n \"CrowdStrike\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["BLINK-API-KEY"] = '<api-key>'
request["Content-Type"] = '*/*'
request.body = "{\n \"case_manager\": [\n \"john.doe@blinkops.com\"\n ],\n \"case_tags\": [\n \"Malware\",\n \"Ransomware\",\n \"Insider Threat\"\n ],\n \"mitre_attack\": [\n \"Reconnaissance\",\n \"Resource Development\"\n ],\n \"name\": \"New Case\",\n \"overview\": \"<p>1. New Malware detected</p>\",\n \"severity\": 3,\n \"sla\": 259200000,\n \"sla_expiry\": 60000,\n \"status\": \"OPEN\",\n \"summary\": \"Summary of the case\",\n \"type\": \"Malware\",\n \"vendors\": [\n \"CrowdStrike\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
}{
"data": {},
"details": "<string>",
"identifier": "<string>",
"message": "<string>",
"status": 404,
"user_error": {}
}Authorizations
Use your API key to access BlinkOps API. To generate an API key, please log in to your BlinkOps account and navigate to the API Keys section in the user settings page. Add the generated key to your request headers as BLINK-API-KEY.
Path Parameters
Workspace ID
Body
*/*
Case Data
Example:
["john.doe@blinkops.com"]
Available options:
Malware, Ransomware, Insider Threat, VIP, Workstation, Server, Data Leak, Data Theft, Account Compromise, Adware, Crypto Miner, Fraud Example:
["Malware", "Ransomware", "Insider Threat"]
Available options:
Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact Example:
["Reconnaissance", "Resource Development"]
Example:
"New Case"
Example:
"<p>1. New Malware detected</p>"
Example:
3
Example:
259200000
Example:
60000
Available options:
OPEN, IN PROGRESS, CLOSED Example:
"OPEN"
Example:
"Summary of the case"
Available options:
Malware, Ransomware, Adware, Spyware, Crypto Miner, Data Exfiltration, Insider Threat, Network Intrusion, DoS, DDoS, MITM, SQL Injection, Email Spoofing, DNS Spoofing, C2 Communications, Rogue Device, Brute Force, Phishing, Compromised Credentials, Account Takeover, Physical, Vulnerability, Reconnaissance, Domain Takeover, Lateral Movement, Network Exposure, Data Exposure, Credential Exposure, Suspicious User Activity, Suspicious Login, Suspicious Network Activity, Suspicious USB Device, Security Policy Violation, Security Compliance Violation Example:
"Malware"
Available options:
CrowdStrike, Checkpoint, Delinea, Securonix, Falcon LogScale, Splunk, ArcSight, SolarWinds Service Desk, Datadog, SentinelOne, Microsoft Defender For Cloud, Microsoft Defender For Cloud Apps, Microsoft Defender For Endpoints Example:
["CrowdStrike"]
Response
OK
Example:
["john.doe@blinkops.com"]
Available options:
Malware, Ransomware, Insider Threat, VIP, Workstation, Server, Data Leak, Data Theft, Account Compromise, Adware, Crypto Miner, Fraud Example:
["Malware", "Ransomware", "Insider Threat"]
Available options:
Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact Example:
["Reconnaissance", "Resource Development"]
Example:
"New Case"
Example:
"<p>1. New Malware detected</p>"
Example:
3
Example:
259200000
Example:
60000
Available options:
OPEN, IN PROGRESS, CLOSED Example:
"OPEN"
Example:
"Summary of the case"
Available options:
Malware, Ransomware, Adware, Spyware, Crypto Miner, Data Exfiltration, Insider Threat, Network Intrusion, DoS, DDoS, MITM, SQL Injection, Email Spoofing, DNS Spoofing, C2 Communications, Rogue Device, Brute Force, Phishing, Compromised Credentials, Account Takeover, Physical, Vulnerability, Reconnaissance, Domain Takeover, Lateral Movement, Network Exposure, Data Exposure, Credential Exposure, Suspicious User Activity, Suspicious Login, Suspicious Network Activity, Suspicious USB Device, Security Policy Violation, Security Compliance Violation Example:
"Malware"
Available options:
CrowdStrike, Checkpoint, Delinea, Securonix, Falcon LogScale, Splunk, ArcSight, SolarWinds Service Desk, Datadog, SentinelOne, Microsoft Defender For Cloud, Microsoft Defender For Cloud Apps, Microsoft Defender For Endpoints Example:
["CrowdStrike"]
Was this page helpful?