I am trying to simulate cases for testing playbook execution flows by ingesting alerts into a Test Environment. For the cases containing multiple Alerts, there is a flag in SimulateAlert api that I think would solve the issue but it isn't working and the individual alerts are being created as separate cases instead of a merged alert case.
{
"caseId": 0,
"alertIdentifier": "string",
"environment": "string",
"shouldDoGrouping": true,
"fieldsToReplace": {
"additionalProp1": "string",
"additionalProp2": "string",
"additionalProp3": "string"
}
Is there any other way I can try to Simulate Cases with multiple alerts via API.
Another issue is that the SimulateAlert endpoint doesn't give any response back. It would be much helpful if it can give back anything like Case ID of the case that was ingested as Test Alert in the response so that it can be used further for reference.
LinkedIn
Twitter
