Skip to content

/AWS1/IF_SHI=>CREATECASE()

About CreateCase

Creates a new case.

Method Signature

IMPORTING

Required arguments:

iv_resolvertype TYPE /AWS1/SHIRESOLVERTYPE /AWS1/SHIRESOLVERTYPE

Required element used in combination with CreateCase to identify the resolver type.

iv_title TYPE /AWS1/SHICASETITLE /AWS1/SHICASETITLE

Required element used in combination with CreateCase to provide a title for the new case.

iv_description TYPE /AWS1/SHICASEDESCRIPTION /AWS1/SHICASEDESCRIPTION

Required element used in combination with CreateCase

to provide a description for the new case.

iv_engagementtype TYPE /AWS1/SHIENGAGEMENTTYPE /AWS1/SHIENGAGEMENTTYPE

Required element used in combination with CreateCase to provide an engagement type for the new cases. Available engagement types include Security Incident | Investigation

iv_reportedincidentstartdate TYPE /AWS1/SHITIMESTAMP /AWS1/SHITIMESTAMP

Required element used in combination with CreateCase to provide an initial start date for the unauthorized activity.

it_impactedaccounts TYPE /AWS1/CL_SHIIMPACTEDACCOUNTS_W=>TT_IMPACTEDACCOUNTS TT_IMPACTEDACCOUNTS

Required element used in combination with CreateCase to provide a list of impacted accounts.

AWS account ID's may appear less than 12 characters and need to be zero-prepended. An example would be 123123123 which is nine digits, and with zero-prepend would be 000123123123. Not zero-prepending to 12 digits could result in errors.

it_watchers TYPE /AWS1/CL_SHIWATCHER=>TT_WATCHERS TT_WATCHERS

Required element used in combination with CreateCase to provide a list of entities to receive notifications for case updates.

Optional arguments:

iv_clienttoken TYPE /AWS1/SHISTRING /AWS1/SHISTRING

The clientToken field is an idempotency key used to ensure that repeated attempts for a single action will be ignored by the server during retries. A caller supplied unique ID (typically a UUID) should be provided.

it_threatactoripaddresses TYPE /AWS1/CL_SHITHREATACTORIP=>TT_THREATACTORIPLIST TT_THREATACTORIPLIST

An optional element used in combination with CreateCase to provide a list of suspicious internet protocol addresses associated with unauthorized activity.

it_impactedservices TYPE /AWS1/CL_SHIIMPACTEDSVCSLIST_W=>TT_IMPACTEDSERVICESLIST TT_IMPACTEDSERVICESLIST

An optional element used in combination with CreateCase to provide a list of services impacted.

it_impactedawsregions TYPE /AWS1/CL_SHIIMPACTEDAWSREGION=>TT_IMPACTEDAWSREGIONLIST TT_IMPACTEDAWSREGIONLIST

An optional element used in combination with CreateCase to provide a list of impacted regions.

it_tags TYPE /AWS1/CL_SHITAGMAP_W=>TT_TAGMAP TT_TAGMAP

An optional element used in combination with CreateCase to add customer specified tags to a case.

RETURNING

oo_output TYPE REF TO /aws1/cl_shicreatecaseresponse /AWS1/CL_SHICREATECASERESPONSE

Domain /AWS1/RT_ACCOUNT_ID
Primitive Type NUMC

Examples

Syntax Example

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->/aws1/if_shi~createcase(
  it_impactedaccounts = VALUE /aws1/cl_shiimpactedaccounts_w=>tt_impactedaccounts(
    ( new /aws1/cl_shiimpactedaccounts_w( |string| ) )
  )
  it_impactedawsregions = VALUE /aws1/cl_shiimpactedawsregion=>tt_impactedawsregionlist(
    ( new /aws1/cl_shiimpactedawsregion( |string| ) )
  )
  it_impactedservices = VALUE /aws1/cl_shiimpactedsvcslist_w=>tt_impactedserviceslist(
    ( new /aws1/cl_shiimpactedsvcslist_w( |string| ) )
  )
  it_tags = VALUE /aws1/cl_shitagmap_w=>tt_tagmap(
    (
      VALUE /aws1/cl_shitagmap_w=>ts_tagmap_maprow(
        key = |string|
        value = new /aws1/cl_shitagmap_w( |string| )
      )
    )
  )
  it_threatactoripaddresses = VALUE /aws1/cl_shithreatactorip=>tt_threatactoriplist(
    (
      new /aws1/cl_shithreatactorip(
        iv_ipaddress = |string|
        iv_useragent = |string|
      )
    )
  )
  it_watchers = VALUE /aws1/cl_shiwatcher=>tt_watchers(
    (
      new /aws1/cl_shiwatcher(
        iv_email = |string|
        iv_jobtitle = |string|
        iv_name = |string|
      )
    )
  )
  iv_clienttoken = |string|
  iv_description = |string|
  iv_engagementtype = |string|
  iv_reportedincidentstartdate = '20150101000000.0000000'
  iv_resolvertype = |string|
  iv_title = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  lv_caseid = lo_result->get_caseid( ).
ENDIF.

Invoke CreateCase

Invoke CreateCase

DATA(lo_result) = lo_client->/aws1/if_shi~createcase(
  it_impactedaccounts = VALUE /aws1/cl_shiimpactedaccounts_w=>tt_impactedaccounts(
    ( new /aws1/cl_shiimpactedaccounts_w( |000000000000| ) )
    ( new /aws1/cl_shiimpactedaccounts_w( |111111111111| ) )
  )
  it_impactedawsregions = VALUE /aws1/cl_shiimpactedawsregion=>tt_impactedawsregionlist(
    ( new /aws1/cl_shiimpactedawsregion( |ap-southeast-1| ) )
  )
  it_impactedservices = VALUE /aws1/cl_shiimpactedsvcslist_w=>tt_impactedserviceslist(
    ( new /aws1/cl_shiimpactedsvcslist_w( |Amazon EC2| ) )
    ( new /aws1/cl_shiimpactedsvcslist_w( |Amazon EKS| ) )
  )
  it_threatactoripaddresses = VALUE /aws1/cl_shithreatactorip=>tt_threatactoriplist(
    (
      new /aws1/cl_shithreatactorip(
        iv_ipaddress = |192.168.192.168|
        iv_useragent = |Browser|
      )
    )
  )
  it_watchers = VALUE /aws1/cl_shiwatcher=>tt_watchers(
    (
      new /aws1/cl_shiwatcher(
        iv_email = |alice@example.com|
        iv_jobtitle = |CEO|
        iv_name = |Alice|
      )
    )
    (
      new /aws1/cl_shiwatcher(
        iv_email = |bob@example.com|
        iv_jobtitle = |CFO|
        iv_name = |Bob|
      )
    )
  )
  iv_description = |Case description|
  iv_engagementtype = |Investigation|
  iv_reportedincidentstartdate = '20230327153201.7890000'
  iv_resolvertype = |Self|
  iv_title = |My sample case|
).