1. Home
    2. Security Operations
    3. Cortex XDR
    4. Cortex XDR™ API Reference
    5. APIs
    6. Incident Management APIs
    7. Retrieve PCAP Packet

    Retrieve PCAP Packet

    Synopsis

    URI
    /public_api/v1/alerts/get_alerts_pcap/
    HTTP Method
    POST
    Required License
    Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per TB

    Description

    Retrieve a list of alert IDs and the associated PCAP triggering packets of PAN NGFW type alerts returned when running the
    Get Alerts
     and
    Get Extra Incident Data
     APIs. Maximum result set size is 100.

    Fields

    The body of this request contains a JSON object with the following fields:
    You can send a request to retrieve either
    all
     or
    filtered
     results.
    Field
    Description
    request_data
    (
    Required
    ) A dictionary containing the API request fields.
    An empty dictionary returns all results.
    filters
    Provides an array of filtered fields. Each JSON object can contain the following keywords:
    • field
      Identifies the alert field the filter is matching. Filters are based on the following keywords:
      • alert_id_list
        —List of integers of the Alert ID
      • alert_source
        —List of strings of the Alert source
      • severity
         —List of strings of the Alert severity
      • creation_time
        —Integer of the Creation time
    • operator
      String that identifies the comparison operator you want to use for this filter. Values keywords:
      in
      • - Permitted for
        alert_id
        ,
        alert_source
        , and
        severity
        .
      gte
      /
      lte
      • Permitted only for
        creation_time
        .
    • value
      Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter:
      • creation_time
        —Integer representing the number of seconds or milliseconds after the Unix epoch, UTC timezone. The value is returned in the response under the
        detection_timestamp
         field, and represented in console under the
        TIMESTAMP
         field.
      • alert_id_list
        —List of integers. Each item in the list must be an alert ID.
      • severity
         Valid values:
        low
        ,
        medium
        ,
        high
        ,
        critical
        ,
        informational
        ,
        unknown
    search_from
    An integer representing the starting offset within the query result set from which you want alerts returned.
    Alerts are returned as a zero-based list. Any alert indexed less than this value is not returned in the final result set and defaults to zero.
    search_to
    An integer representing the end offset within the result set after which you do not want alerts returned.
    Alerts in the alerts list that are indexed higher than this value are not returned in the final results set. Defaults to 100, which returns all alerts to the end of the list.
    sort
    Identifies the sort order for the result set. By default the sort is defined as
    creation_time
    ,
    DESC
    .
    • field
      —Can either be
      severity
       or
      creation_time
      .
    • keyword
      —Can either be
      ASC
       (ascending order) or
      DESC
       (descending order).
    Request Example
    Request all results:
    curl -X POST https://api-{fqdn}/public_api/v1/alerts/get_alerts/ \
-H "x-xdr-auth-id:{API_KEY_ID}" \
-H "Authorization:{API_KEY}" \
-H "Content-Type:application/json" \
-d '{ 
   "request_data":{}
   }'
    Request filtered results:
    
curl -X POST https://api-{fqdn}/public_api/v1/alerts/get_alerts_pcap/ \    
-H "x-xdr-auth-id:{API_KEY_ID}" \    
-H "Authorization:{API_KEY}" \    
-H "Content-Type:application/json" \    
-d '{ 
   "request_data":{ 
      "filters":[ 
         { 
            "field":"severity",
            "operator":"in",
            "value":[ 
               "medium",
               "high"
            ]
         }
      ],
      "search_from":0,
      "search_to":5,
      "sort":{ 
         "field":"severity",
         "keyword":"asc"
      }
   }
}’

    Success Response

    Upon success, the HTTP response code is 200. In addition, this API returns a JSON object containing the query status, as well as an array of JSON objects, each of which represents a single alert.
    Field
    Description
    reply
    JSON object containing the query result.
    total_count
    Number of total results of this filter without paging. If filter returned 10,000 results or more than 9,999 will be the value and you can use paging to view the entire set of data.
    result_count
    Number of alerts actually returned as result (integer).
    alerts
    A list of alerts (list).
    Success Response Example
    
{
    "reply": [
        {
            "id": 283839,
            "pcap_data": ""
        },
        {
            "id": 319541,
            "pcap_data": "<pcap_data>"
        }
    ]
}
    For alerts without PCAP data an empty string is returned.

    Error Response

    Upon error, the reply includes an HTTP response code, an error message, and additional information describing the error. The HTTP response code is one of the following:
    Field
    Description
    400
    Bad Request. Got an invalid JSON.
    401
    Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
    402
    Unauthorized access. User does not have the required license type to run this API.
    403
    Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
    500
    Internal server error. A unified status for API communication type errors.
    Error Response Format
    {"reply": {"err_code": STATUS_CODE, "err_msg": GENERAL_MESSAGE, "err_extra": EXTRA_DATA}}

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2022 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo