cURL
curl --request PUT \
--url 'https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}' \
--header 'BLINK-API-KEY: <api-key>' \
--header 'Content-Type: application/json' \
--data '{
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
}'import requests
url = "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}"
payload = {
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
}
headers = {
"BLINK-API-KEY": "<api-key>",
"Content-Type": "application/json"
}
response = requests.request("PUT", url, json=payload, headers=headers)
print(response.text)
const url = 'https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}';
const options = {
method: 'PUT',
headers: {'BLINK-API-KEY': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
})
};
fetch(url, options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => '{"case_manager":["john.doe@blinkops.com"],"case_tags":["Malware","Ransomware","Insider Threat"],"mitre_attack":["Reconnaissance","Resource Development"],"name":"New Case","overview":"<p>1. New Malware detected</p>","severity":3,"sla":259200000,"sla_expiry":60000,"status":"OPEN","summary":"Summary of the case","type":"Malware","vendors":["CrowdStrike"]}',
CURLOPT_HTTPHEADER => [
"BLINK-API-KEY: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}"
payload := strings.NewReader(`{"case_manager":["john.doe@blinkops.com"],"case_tags":["Malware","Ransomware","Insider Threat"],"mitre_attack":["Reconnaissance","Resource Development"],"name":"New Case","overview":"<p>1. New Malware detected</p>","severity":3,"sla":259200000,"sla_expiry":60000,"status":"OPEN","summary":"Summary of the case","type":"Malware","vendors":["CrowdStrike"]}`)
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("BLINK-API-KEY", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(res)
fmt.Println(string(body))
}
HttpResponse<String> response = Unirest.put("https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}")
.header("BLINK-API-KEY", "<api-key>")
.header("Content-Type", "application/json")
.body("{\"case_manager\":[\"john.doe@blinkops.com\"],\"case_tags\":[\"Malware\",\"Ransomware\",\"Insider Threat\"],\"mitre_attack\":[\"Reconnaissance\",\"Resource Development\"],\"name\":\"New Case\",\"overview\":\"<p>1. New Malware detected</p>\",\"severity\":3,\"sla\":259200000,\"sla_expiry\":60000,\"status\":\"OPEN\",\"summary\":\"Summary of the case\",\"type\":\"Malware\",\"vendors\":[\"CrowdStrike\"]}")
.asString();
require 'uri'
require 'net/http'
url = URI("https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["BLINK-API-KEY"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\"case_manager\":[\"john.doe@blinkops.com\"],\"case_tags\":[\"Malware\",\"Ransomware\",\"Insider Threat\"],\"mitre_attack\":[\"Reconnaissance\",\"Resource Development\"],\"name\":\"New Case\",\"overview\":\"<p>1. New Malware detected</p>\",\"severity\":3,\"sla\":259200000,\"sla_expiry\":60000,\"status\":\"OPEN\",\"summary\":\"Summary of the case\",\"type\":\"Malware\",\"vendors\":[\"CrowdStrike\"]}"
response = http.request(request)
puts response.read_body
{
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
}{
"data": {},
"details": "<string>",
"identifier": "<string>",
"message": "<string>",
"status": 404,
"user_error": {}
}Case Management
Update a Case
API endpoint to update an existing case in Blink’s case management system.
PUT
/
workspace
/
{ws_id}
/
case_management
/
table
/
cases
/
{case_id}
cURL
curl --request PUT \
--url 'https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}' \
--header 'BLINK-API-KEY: <api-key>' \
--header 'Content-Type: application/json' \
--data '{
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
}'import requests
url = "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}"
payload = {
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
}
headers = {
"BLINK-API-KEY": "<api-key>",
"Content-Type": "application/json"
}
response = requests.request("PUT", url, json=payload, headers=headers)
print(response.text)
const url = 'https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}';
const options = {
method: 'PUT',
headers: {'BLINK-API-KEY': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
})
};
fetch(url, options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => '{"case_manager":["john.doe@blinkops.com"],"case_tags":["Malware","Ransomware","Insider Threat"],"mitre_attack":["Reconnaissance","Resource Development"],"name":"New Case","overview":"<p>1. New Malware detected</p>","severity":3,"sla":259200000,"sla_expiry":60000,"status":"OPEN","summary":"Summary of the case","type":"Malware","vendors":["CrowdStrike"]}',
CURLOPT_HTTPHEADER => [
"BLINK-API-KEY: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}"
payload := strings.NewReader(`{"case_manager":["john.doe@blinkops.com"],"case_tags":["Malware","Ransomware","Insider Threat"],"mitre_attack":["Reconnaissance","Resource Development"],"name":"New Case","overview":"<p>1. New Malware detected</p>","severity":3,"sla":259200000,"sla_expiry":60000,"status":"OPEN","summary":"Summary of the case","type":"Malware","vendors":["CrowdStrike"]}`)
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("BLINK-API-KEY", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(res)
fmt.Println(string(body))
}
HttpResponse<String> response = Unirest.put("https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}")
.header("BLINK-API-KEY", "<api-key>")
.header("Content-Type", "application/json")
.body("{\"case_manager\":[\"john.doe@blinkops.com\"],\"case_tags\":[\"Malware\",\"Ransomware\",\"Insider Threat\"],\"mitre_attack\":[\"Reconnaissance\",\"Resource Development\"],\"name\":\"New Case\",\"overview\":\"<p>1. New Malware detected</p>\",\"severity\":3,\"sla\":259200000,\"sla_expiry\":60000,\"status\":\"OPEN\",\"summary\":\"Summary of the case\",\"type\":\"Malware\",\"vendors\":[\"CrowdStrike\"]}")
.asString();
require 'uri'
require 'net/http'
url = URI("https://<your-tenant>.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/cases/{case_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["BLINK-API-KEY"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\"case_manager\":[\"john.doe@blinkops.com\"],\"case_tags\":[\"Malware\",\"Ransomware\",\"Insider Threat\"],\"mitre_attack\":[\"Reconnaissance\",\"Resource Development\"],\"name\":\"New Case\",\"overview\":\"<p>1. New Malware detected</p>\",\"severity\":3,\"sla\":259200000,\"sla_expiry\":60000,\"status\":\"OPEN\",\"summary\":\"Summary of the case\",\"type\":\"Malware\",\"vendors\":[\"CrowdStrike\"]}"
response = http.request(request)
puts response.read_body
{
"case_manager": [
"john.doe@blinkops.com"
],
"case_tags": [
"Malware",
"Ransomware",
"Insider Threat"
],
"mitre_attack": [
"Reconnaissance",
"Resource Development"
],
"name": "New Case",
"overview": "<p>1. New Malware detected</p>",
"severity": 3,
"sla": 259200000,
"sla_expiry": 60000,
"status": "OPEN",
"summary": "Summary of the case",
"type": "Malware",
"vendors": [
"CrowdStrike"
]
}{
"data": {},
"details": "<string>",
"identifier": "<string>",
"message": "<string>",
"status": 404,
"user_error": {}
}Authorizations
Body
*/*
Case Data
Available options:
Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact Example:
["Reconnaissance", "Resource Development"]
Available options:
Malware, Ransomware, Adware, Spyware, Crypto Miner, Data Exfiltration, Insider Threat, Network Intrusion, DoS, DDoS, MITM, SQL Injection, Email Spoofing, DNS Spoofing, C2 Communications, Rogue Device, Brute Force, Phishing, Compromised Credentials, Account Takeover, Physical, Vulnerability, Reconnaissance, Domain Takeover, Lateral Movement, Network Exposure, Data Exposure, Credential Exposure, Suspicious User Activity, Suspicious Login, Suspicious Network Activity, Suspicious USB Device, Security Policy Violation, Security Compliance Violation Example:
"Malware"
Response
OK
Available options:
Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact Example:
["Reconnaissance", "Resource Development"]
Available options:
Malware, Ransomware, Adware, Spyware, Crypto Miner, Data Exfiltration, Insider Threat, Network Intrusion, DoS, DDoS, MITM, SQL Injection, Email Spoofing, DNS Spoofing, C2 Communications, Rogue Device, Brute Force, Phishing, Compromised Credentials, Account Takeover, Physical, Vulnerability, Reconnaissance, Domain Takeover, Lateral Movement, Network Exposure, Data Exposure, Credential Exposure, Suspicious User Activity, Suspicious Login, Suspicious Network Activity, Suspicious USB Device, Security Policy Violation, Security Compliance Violation Example:
"Malware"
Was this page helpful?