{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43930,"path":"security-management/data-loss-prevention/inbound-integration-dlp.md","title":"Inbound Integration for Data Loss Prevention Incident Response","bundle":null,"doc_type":null,"release":"australia","body":"\n# Inbound Integration for Data Loss Prevention Incident Response\n\nCreate single or multiple DLP incidents by using the Inbound REST API.\n\n## Create a single DLP incident\n\nRole required: sn\\_dlir.api\\_integration\\_user.\n\nTo create a single DLP incident, define the following parameters as necessary:\n\n<table id=\"table_kcx_4ch_h5b\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nHTTP Method\n\n</td><td>\n\nPOST\n\n</td></tr><tr><td>\n\nURL\n\n</td><td>\n\n`https://{instance}/api/now/import/sn_dlir_incident_import`\n\n</td></tr><tr><td>\n\nRequest Header\n\n</td><td>\n\n-   **Accept:**\n\n**application/json**\n\n-   **Content-Type:**\n\n**application/json**\n\n\n</td></tr><tr><td>\n\nSample Payload\n\n</td><td>\n\n```\n{\n    \"application_window_title\": \"<value>\",\n    \"assigned_to\": \"<value>\",\n    \"attachments\": \"<value>\",\n    \"data_owner_email\": \"<value>\",\n    \"destination\": \"<value>\",\n    \"dest_ip\": \"<value>\",\n    \"dest_ip_port\": \"<value>\",\n    \"detection_date\": \"<value>\",\n    \"endpoint_on_corporate_net\": \"<value>\",\n    \"files\": \"\",\n    \"file_created\": \"\",\n    \"file_created_by\": \"\",\n    \"file_location\": \"\",\n    \"file_modified_by\": \"\",\n    \"file_name\": \"\",\n    \"file_owner\": \"\",\n    \"file_permissions\": \"\",\n    \"ftp_user_name\": \"\",\n    \"last_modified\": \"\",\n    \"machine_ip\": \"\",\n    \"machine_name\": \"\",\n    \"match_count\": \"\",\n    \"policy_id\": \"\",\n    \"policy_name\": \"\",\n    \"printer_name\": \"\",\n    \"printer_type\": \"\",\n    \"print_job_name\": \"\",\n    \"recipients\": \"\",\n    \"scanned_machine\": \"\",\n    \"scan_source\": \"\",\n    \"seen_before\": \"\",\n    \"sender\":\"\",\n    \"source\":\"\",\n    \"source_file\":\"\",\n    \"source_ip\":\"\",\n    \"source_ip_port\":\"\",\n    \"subject\":\"\",\n    \"url\":\"\",\n    \"user_justification\":\"\"\n}\n```\n\n</td></tr><tr><td>\n\nSample Response\n\n</td><td>\n\n```\n{\n    \"import_set\": \"ISET0010003\",\n    \"staging_table\": \"sn_dlir_incident_import\",\n    \"result\": [\n        {\n            \"transform_map\": \"\",\n            \"table\": \"sn_dlir_incident\",\n            \"display_name\": \"number\",\n            \"display_value\": \"DLP0001012\",\n            \"record_link\": \"https://{instance}/api/now/table/sn_dlir_incident/7cda322297c2411056a43d1e6253af1f\",\n            \"status\": \"inserted\",\n            \"sys_id\": \"7cda322297c2411056a43d1e6253af1f\"\n        }\n    ]\n}\n```\n\n</td></tr></tbody>\n</table>## Create multiple DLP incidents\n\nRole required: sn\\_dlir.api\\_integration\\_user.\n\nTo create multiple DLP incidents from the same request, define the following parameters as necessary:\n\n<table id=\"table_o4d_g2h_h5b\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nHTTP Method\n\n</td><td>\n\nPOST\n\n</td></tr><tr><td>\n\nURL\n\n</td><td>\n\n`https://{instance}/api/now/import/sn_dlir_incident_import/insertMultiple`\n\n</td></tr><tr><td>\n\nRequest Header\n\n</td><td>\n\n-   **Accept:**\n\n**application/json**\n\n-   **Content-Type:**\n\n**application/json**\n\n\n</td></tr><tr><td>\n\nSample Payload\n\n</td><td>\n\n```\n{\n    \"records\": [\n        {\n            \"file_name\": \"<value>\",\n            \"file_modified_by\": \"<value>\",\n            \"work_notes\": \"<value>\",\n            \"url\": \"<value>\",\n            \"scan_source\": \"<value>\",\n            \"data_owner_email\": \"<value>\",\n            \"file_created_by\": \"<value>\",\n            \"file_owner\": \"<value>\",\n            \"policy_name\": \"<value>\"\n        },\n        {\n            \"dest_ip\": \"<value>\",\n            \"dest_ip_port\": \"<value>\",\n            \"detection_date\": \"<value>\",\n            \"endpoint_on_corporate_net\": \"<value>\",\n            \"files\": \"<value>\",\n            \"file_created\": \"<value>\",\n            \"file_created_by\": \"<value>\",\n            \"file_location\": \"<value>\",\n            \"file_modified_by\": \"<value>\",\n            \"file_name\": \"<value>\",\n            \"file_owner\": \"<value>\",\n        }\n    ]\n}\n```\n\n</td></tr><tr><td>\n\nSample Response\n\n</td><td>\n\n```\n{\n    \"import_set_id\": \"a38f69229734dd1056a43d1e6253af75\",\n    \"multi_import_set_id\": \"e78f69229734dd1056a43d1e6253af75\"\n}\n```\n\n</td></tr></tbody>\n</table>**Note:** By default, the transformation is asynchronous. To set synchronous transformation, create a new record in the REST Insert Multiples \\[sys\\_rest\\_insert\\_multiple\\] table, select the source table as **sn\\_dlir\\_incident\\_import**, and set the transformation to **synchronous**.\n\n"}}