Get Incidents
Get a list of incidents.
Synopsis
URI | /public_api/v1/incidents/get_incidents/ |
HTTP Method | POST |
Required License | Cortex XDR Prevent, Cortex XDR Pro per Endpoint,
or Cortex XDR Pro per TB |
Description
Get a list of incidents filtered
by a list of incident IDs, modification time, or creation time.
- Response is concatenated usingANDcondition (OR is not supported).
- Maximum result set size is 100.
- Offsetis the zero-based number of incidents from the start of the result set.
Request Fields
The body of this request
contains a JSON object with the following fields:
You can
send a request to retrieve either
all
or filtered
results. Field | Description |
---|---|
request_data | ( Required ) A dictionary containing
the API request fields.An empty dictionary returns all results. |
filters | Provides an array of filtered fields. Each
JSON object must contain the following keywords:
|
search_from | Integer representing the starting offset
within the query result set from which you want incidents returned. Incidents
are returned as a zero-based list. Any incident indexed less than
this value is not returned in the final result set and defaults
to zero. |
search_to | Integer representing the end offset within
the result set after which you do not want incidents returned. Incidents
in the incident list that are indexed higher than this value are
not returned in the final results set. Defaults to 100, which returns
all incidents to the end of the list. |
sort | Identifies the sort order for the result set.
|
Request Example
Request all results:
curl -X POST https://api-{fqdn}/public_api/v1/incidents/get_incidents/ \ -H "x-xdr-auth-id:{API_KEY_ID}" \ -H "Authorization:{API_KEY}" \ -H "Content-Type:application/json" \ -d '{ "request_data":{} }'
Request filtered results:
curl -X POST https://api-{fqdn}/public_api/v1/incidents/get_incidents/ \ -H "x-xdr-auth-id:{API_KEY_ID}" \ -H "Authorization:{API_KEY}" \ -H "Content-Type:application/json" \ -d '{ "request_data": { "filters": [ { "field": "incident_id_list", "operator": "in", "value": ["<incident ID>", "<incident ID>"] } ], "search_from": 0, "search_to": 100, "sort": { "field": "creation_time", "keyword": "desc" } } }'
Success Response
Upon success,
the HTTP response code is 200. In addition, this API returns a JSON
object containing the query status, as well as an array of JSON objects,
each of which represents a single incident.
Field | Description |
---|---|
total_count | Total number of possible results, value is
limited to 10,000 (integer). |
result_count | Number of incidents actually returned as result
(integer). |
incidents | A list of incidents (list). |
Success Response Example
{ "reply":{ "total_count":1, "result_count":1, "incidents":[ { "incident_id":"<incident ID>", "incident_name": "test", "creation_time":1577024425126, "modification_time":1577024425126, "detection_time":null, "status":"new", "severity":"medium", "description":"'Memory Corruption Exploit' generated by XDR Agent", "assigned_user_mail":null, "assigned_user_pretty_name":null, "alert_count":1, "low_severity_alert_count":0, "med_severity_alert_count":1, "high_severity_alert_count":0, "user_count":1, "host_count":1, "notes":null, "resolve_comment":null, "manual_severity":null, "manual_description":null, "xdr_url":"https://<link to incident>", "starred":false, "hosts":[ "<host ID>" ], "users":[ "test_1", "test_2" ], "incident_sources":[ "XDR Agent", "XDR BIOC" ], "rule_based_score":342, "manual_score":null ] } ] } }
Error Response
Upon error,
the reply includes an HTTP response code, an error message, and
additional information describing the error. The HTTP response code is
one of the following:
Field | Description |
---|---|
400 | Bad Request. Got an invalid JSON. |
401 | Unauthorized access. An issue occurred during authentication.
This can indicate an incorrect key, id, or other invalid authentication
parameters. |
402 | Unauthorized access. User does not have the
required license type to run this API. |
403 | Forbidden access. The provided API Key does
not have the required RBAC permissions to run this API. |
500 | Internal server error. A unified status for
API communication type errors. |
Error Response Format
{"reply": {"err_code": STATUS_CODE, "err_msg": GENERAL_MESSAGE, "err_extra": EXTRA_DATA}}
Recommended For You
Recommended Videos
Recommended videos not found.