create_case ¶

def create_case(
    self,
    resolver_type: "capo_security_ir.types.resolver_type.ResolverType",
    title: "capo_security_ir.types.case_title.CaseTitle",
    description: "capo_security_ir.types.case_description.CaseDescription",
    engagement_type: "capo_security_ir.types.engagement_type.EngagementType",
    reported_incident_start_date: datetime.datetime,
    impacted_accounts: "capo_security_ir.types.impacted_accounts.ImpactedAccounts",
    watchers: "capo_security_ir.types.watchers.Watchers",
    *,
    config_overrides: Optional[SecurityIRClientConfig] = None,
    client_token: Optional[str] = None,
    threat_actor_ip_addresses: Optional[
        "capo_security_ir.types.threat_actor_ip_list.ThreatActorIpList"
    ] = None,
    impacted_services: Optional[
        "capo_security_ir.types.impacted_services_list.ImpactedServicesList"
    ] = None,
    impacted_aws_regions: Optional[
        "capo_security_ir.types.impacted_aws_region_list.ImpactedAwsRegionList"
    ] = None,
    tags: Optional["capo_security_ir.types.tag_map.TagMap"] = None,
) -> "capo_security_ir.types.create_case_response.CreateCaseResponse":
    """<p>Creates a new case.</p>

    Args:
        client_token: <note> <p>The <code>clientToken</code> field is an idempotency key used to ensure that repeated attempts for a single action will be ignored by the server during retries. A caller supplied unique ID (typically a UUID) should be provided. </p> </note>
        resolver_type: <p>Required element used in combination with CreateCase to identify the resolver type.</p>
        title: <p>Required element used in combination with CreateCase to provide a title for the new case.</p>
        description: <p>Required element used in combination with CreateCase</p> <p>to provide a description for the new case.</p>
        engagement_type: <p>Required element used in combination with CreateCase to provide an engagement type for the new cases. Available engagement types include Security Incident | Investigation </p>
        reported_incident_start_date: <p>Required element used in combination with CreateCase to provide an initial start date for the unauthorized activity. </p>
        impacted_accounts: <p>Required element used in combination with CreateCase to provide a list of impacted accounts.</p> <note> <p> AWS account ID's may appear less than 12 characters and need to be zero-prepended. An example would be <code>123123123</code> which is nine digits, and with zero-prepend would be <code>000123123123</code>. Not zero-prepending to 12 digits could result in errors. </p> </note>
        watchers: <p>Required element used in combination with CreateCase to provide a list of entities to receive notifications for case updates. </p>
        threat_actor_ip_addresses: <p>An optional element used in combination with CreateCase to provide a list of suspicious internet protocol addresses associated with unauthorized activity. </p>
        impacted_services: <p>An optional element used in combination with CreateCase to provide a list of services impacted.</p>
        impacted_aws_regions: <p>An optional element used in combination with CreateCase to provide a list of impacted regions.</p>
        tags: <p>An optional element used in combination with CreateCase to add customer specified tags to a case.</p>

    Raises:
        capo_security_ir.errors.access_denied_exception.AccessDeniedException: <p/>
        capo_security_ir.errors.conflict_exception.ConflictException: <p/>
        capo_security_ir.errors.internal_server_exception.InternalServerException: <p/>
        capo_security_ir.errors.invalid_token_exception.InvalidTokenException: <p/>
        capo_security_ir.errors.resource_not_found_exception.ResourceNotFoundException: <p/>
        capo_security_ir.errors.security_incident_response_not_active_exception.SecurityIncidentResponseNotActiveException: <p/>
        capo_security_ir.errors.service_quota_exceeded_exception.ServiceQuotaExceededException: <p/>
        capo_security_ir.errors.throttling_exception.ThrottlingException: <p/>
        capo_security_ir.errors.validation_exception.ValidationException: <p/>
        capo_security_ir.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        Invoke CreateCase

        >>> client.create_case(resolver_type='Self', title='My sample case', description='Case description', reported_incident_start_date='2023-03-27T15:32:01.789Z', engagement_type='Investigation', watchers=[{'email': '[email protected]', 'name': 'Alice', 'jobTitle': 'CEO'}, {'email': '[email protected]', 'name': 'Bob', 'jobTitle': 'CFO'}], impacted_accounts=['000000000000', '111111111111'], impacted_services=['Amazon EC2', 'Amazon EKS'], impacted_aws_regions=[{'region': 'ap-southeast-1'}], threat_actor_ip_addresses=[{'ipAddress': '192.168.192.168', 'userAgent': 'Browser'}])
    """

    def _handler(
        req: "OperationRequest[capo_security_ir.types.create_case_request.CreateCaseRequest]",
    ) -> OperationResponse[
        "capo_security_ir.types.create_case_response.CreateCaseResponse"
    ]:
        import capo_security_ir._operations.security_incident_response.create_case

        output, http_response = (
            capo_security_ir._operations.security_incident_response.create_case.create_case(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_security_ir.types.create_case_request.CreateCaseRequest",
    ) -> dict[str, Any]:
        import capo_security_ir.types.create_case_request

        return capo_security_ir.types.create_case_request.redact_sensitive(input_)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("CreateCase", redact_input=_redact_input)
    )
    input_: capo_security_ir.types.create_case_request.CreateCaseRequest = {
        "resolver_type": resolver_type,
        "title": title,
        "description": description,
        "engagement_type": engagement_type,
        "reported_incident_start_date": reported_incident_start_date,
        "impacted_accounts": impacted_accounts,
        "watchers": watchers,
    }
    if client_token is None:
        client_token = str(uuid.uuid4())
    input_["client_token"] = client_token
    if threat_actor_ip_addresses is not None:
        input_["threat_actor_ip_addresses"] = threat_actor_ip_addresses
    if impacted_services is not None:
        input_["impacted_services"] = impacted_services
    if impacted_aws_regions is not None:
        input_["impacted_aws_regions"] = impacted_aws_regions
    if tags is not None:
        input_["tags"] = tags

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output