Supported Filter Fields & Operators

Field	Supported Operators	Value Type
`case_id`	`in`, `nin`	Array of integers
`starred`	`in`, `nin`	Boolean
`case_domain`	`in`, `nin`	Array of strings (e.g. 'Security', 'Posture', 'Health')
`severity`	`in`, `nin`	Array of strings: `info`, `low`, `medium`, `high`, `critical`
`creation_time`	`gte`, `lte`, `eq`, `neq`	Integer (epoch milliseconds)
`last_update_time`	`gte`, `lte`, `eq`, `neq`	Integer (epoch milliseconds)
`status_progress`	`in`, `nin`	Array of strings (e.g. 'New', 'In Progress', 'Resolved', plus custom statuses)
`assigned_user`	`in`, `nin`	Array of strings (email addresses)
`assigned_user_pretty`	`in`, `nin`	Array of strings (display names)
`asset_ids`	`contains`	Array of strings
`asset_names`	`contains`	Array of strings
`asset_classes`	`contains`	Array of strings
`asset_group_ids`	`contains`	Array of strings
`asset_categories`	`contains`	Array of strings
`asset_regions`	`contains`	Array of strings
`asset_providers`	`contains`	Array of strings
`asset_accounts`	`contains`	Array of strings
`asset_types`	`contains`	Array of strings
`asset_cloud_account_names`	`contains`	Array of strings
`asset_external_provider_ids`	`contains`	Array of strings

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.

Request headers

Authorization String required

{api_key}

Example: authorization_example

x-xdr-auth-id String required

{api_key_id}

Example: xXdrAuthId_example

CLIENT REQUEST

          curl -X 'POST'

        -H
        'Accept: application/json'
      
        -H
        'Content-Type: application/json'
      
          -H
          'Authorization: authorization_example'
          -H
          'x-xdr-auth-id: xXdrAuthId_example'
      
      'https://api-yourfqdn/public_api/v1/case/search'
    
      -d
      ''

import http.client

conn = http.client.HTTPSConnection("api-yourfqdn")

payload = "{\"request_data\":{\"filters\":[{\"field\":\"case_id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"case_id\",\"keyword\":\"asc\"}}}"

headers = {
    'Authorization': "SOME_STRING_VALUE",
    'x-xdr-auth-id': "SOME_STRING_VALUE",
    'content-type': "application/json"
    }

conn.request("POST", "/public_api/v1/case/search", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))

require 'uri'
require 'net/http'
require 'openssl'

url = URI("https://api-yourfqdn/public_api/v1/case/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'SOME_STRING_VALUE'
request["x-xdr-auth-id"] = 'SOME_STRING_VALUE'
request["content-type"] = 'application/json'
request.body = "{\"request_data\":{\"filters\":[{\"field\":\"case_id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"case_id\",\"keyword\":\"asc\"}}}"

response = http.request(request)
puts response.read_body

const data = JSON.stringify({
  "request_data": {
    "filters": [
      {
        "field": "case_id",
        "operator": "in",
        "value": [
          0
        ]
      }
    ],
    "search_from": 0,
    "search_to": 100,
    "sort": {
      "field": "case_id",
      "keyword": "asc"
    }
  }
});

const xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function () {
  if (this.readyState === this.DONE) {
    console.log(this.responseText);
  }
});

xhr.open("POST", "https://api-yourfqdn/public_api/v1/case/search");
xhr.setRequestHeader("Authorization", "SOME_STRING_VALUE");
xhr.setRequestHeader("x-xdr-auth-id", "SOME_STRING_VALUE");
xhr.setRequestHeader("content-type", "application/json");

xhr.send(data);

HttpResponse<String> response = Unirest.post("https://api-yourfqdn/public_api/v1/case/search")
  .header("Authorization", "SOME_STRING_VALUE")
  .header("x-xdr-auth-id", "SOME_STRING_VALUE")
  .header("content-type", "application/json")
  .body("{\"request_data\":{\"filters\":[{\"field\":\"case_id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"case_id\",\"keyword\":\"asc\"}}}")
  .asString();

import Foundation

let headers = [
  "Authorization": "SOME_STRING_VALUE",
  "x-xdr-auth-id": "SOME_STRING_VALUE",
  "content-type": "application/json"
]
let parameters = ["request_data": [
    "filters": [
      [
        "field": "case_id",
        "operator": "in",
        "value": [0]
      ]
    ],
    "search_from": 0,
    "search_to": 100,
    "sort": [
      "field": "case_id",
      "keyword": "asc"
    ]
  ]] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api-yourfqdn/public_api/v1/case/search")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-yourfqdn/public_api/v1/case/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "{\"request_data\":{\"filters\":[{\"field\":\"case_id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"case_id\",\"keyword\":\"asc\"}}}",
  CURLOPT_HTTPHEADER => [
    "Authorization: SOME_STRING_VALUE",
    "content-type: application/json",
    "x-xdr-auth-id: SOME_STRING_VALUE"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_URL, "https://api-yourfqdn/public_api/v1/case/search");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "Authorization: SOME_STRING_VALUE");
headers = curl_slist_append(headers, "x-xdr-auth-id: SOME_STRING_VALUE");
headers = curl_slist_append(headers, "content-type: application/json");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{\"request_data\":{\"filters\":[{\"field\":\"case_id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"case_id\",\"keyword\":\"asc\"}}}");

CURLcode ret = curl_easy_perform(hnd);

var client = new RestClient("https://api-yourfqdn/public_api/v1/case/search");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("x-xdr-auth-id", "SOME_STRING_VALUE");
request.AddHeader("content-type", "application/json");
request.AddParameter("application/json", "{\"request_data\":{\"filters\":[{\"field\":\"case_id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"case_id\",\"keyword\":\"asc\"}}}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

Body parameters

required

application/json

request_dataobject

filtersarray

[

fieldstring (Enum)

Specifies the field to filter cases by. See the endpoint description for supported operators per field.

Allowed values:"case_id""starred""case_domain""severity""creation_time""last_update_time""status_progress""assigned_user""assigned_user_pretty""asset_ids""asset_names""asset_classes""asset_group_ids""asset_categories""asset_regions""asset_providers""asset_accounts""asset_types""asset_cloud_account_names""asset_external_provider_ids"

operatorstring (Enum)

Comparison operator. Allowed operators depend on the field:

in, nin: For case_id, case_domain, severity, status_progress, assigned_user, assigned_user_pretty.
gte, lte, eq, neq: For time fields (creation_time, last_update_time).
contains: For asset fields (asset_ids, asset_names, asset_classes, asset_group_ids, asset_categories, asset_regions, asset_providers, asset_accounts, asset_types, asset_cloud_account_names, asset_external_provider_ids).

Allowed values:"in""nin""gte""lte""eq""neq""contains"

valueobject

Value(s) for filtering the cases.

One of

Array

integer

Value(s) for filtering the cases.

string

Value(s) for filtering the cases.

boolean

Value(s) for filtering the cases.

]

search_frominteger

Starting index for pagination.

search_tointeger

Ending index for pagination.

Default:100

sortobject

fieldstring (Enum)

Allowed values:"case_id""severity""creation_time"

keywordstring (Enum)

Sort order (ascending or descending).

Allowed values:"asc""desc"

REQUEST

{
  "request_data": {
    "filters": [
      {
        "field": "case_id",
        "operator": "in",
        "value": [
          0
        ]
      }
    ],
    "search_from": 0,
    "search_to": 0,
    "sort": {
      "field": "case_id",
      "keyword": "asc"
    }
  }
}

{
  "request_data": {
    "filters": [
      {
        "field": "case_id",
        "operator": "in",
        "value": [
          "example"
        ]
      }
    ],
    "search_from": 0,
    "search_to": 0,
    "sort": {
      "field": "case_id",
      "keyword": "asc"
    }
  }
}

{
  "request_data": {
    "filters": [
      {
        "field": "case_id",
        "operator": "in",
        "value": 0
      }
    ],
    "search_from": 0,
    "search_to": 0,
    "sort": {
      "field": "case_id",
      "keyword": "asc"
    }
  }
}

{
  "request_data": {
    "filters": [
      {
        "field": "case_id",
        "operator": "in",
        "value": "example"
      }
    ],
    "search_from": 0,
    "search_to": 0,
    "sort": {
      "field": "case_id",
      "keyword": "asc"
    }
  }
}

{
  "request_data": {
    "filters": [
      {
        "field": "case_id",
        "operator": "in",
        "value": false
      }
    ],
    "search_from": 0,
    "search_to": 0,
    "sort": {
      "field": "case_id",
      "keyword": "asc"
    }
  }
}

Responses

Successful response with cases

Body

application/json

replyobject

TOTAL_COUNTinteger

FILTER_COUNTinteger

DATAarray

[

case_idinteger

Unique identifier for the case

Example:834

is_blockedboolean

Indicates if the case is blocked due to RBAC restrictions

case_namestring

Name of the case

Example:"Windows Installer exploitation for local privilege escalation"

creation_timeintegerint64

Timestamp of case creation in epoch milliseconds

Example:1776902615000

modification_timeintegerint64

Timestamp of last modification in epoch milliseconds

Example:1776902615000

status_progressstring

Current status of the case. Built-in values are 'New', 'In Progress', and 'Resolved'. Additional custom statuses may be configured per tenant and case domain.

Example:"Resolved"

resolve_reasonstring

Resolution reason when the case is resolved. Null when the case is not resolved. Built-in values include 'Resolved - Known Issue', 'Resolved - Duplicate Case', 'Resolved - False Positive', 'Resolved - Other', 'Resolved - True Positive', 'Resolved - Security Testing'. Additional values such as 'Resolved - Dismissed', 'Resolved - Fixed', and 'Resolved - Risk Accepted' may be available depending on tenant licensing. Custom resolution reasons may also be configured per tenant and case domain.

Example:"Resolved - Other"

severitystring (Enum)

Severity level of the case (lowercase)

Example:"high"

Allowed values:"info""low""medium""high""critical"

descriptionstring

Detailed description of the case. May be null if no description is set.

Example:"Reduce risk from the listed configuration issues through the primary AWS asset."

assigned_user_mailstring

Email address of the assigned user. Null if no user is assigned.

Example:"user@example.com"

assigned_user_pretty_namestring

Display name of the assigned user. Null if no user is assigned.

Example:"Jane Smith"

issue_countinteger

Total number of issues in the case

Example:1

user_severitystring (Enum)

User-defined severity override (lowercase). Null if not set. Allowed values: 'low', 'medium', 'high', 'critical'.

Example:"medium"

Allowed values:"low""medium""high""critical"

notesstring

Free-text notes associated with the case. Null if not set.

Example:"Investigation complete, no further action needed."

low_severity_issue_countinteger

Number of low severity issues

med_severity_issue_countinteger

Number of medium severity issues

high_severity_issue_countinteger

Number of high severity issues

Example:1

critical_severity_issue_countinteger

Number of critical severity issues

user_countinteger

Number of users associated with the case

host_countinteger

Number of hosts associated with the case

Example:1

resolve_commentstring

Free-text comment provided when resolving the case. Null when the case is not resolved or no comment was provided.

Example:"Resolved via public API."

resolved_timestampintegerint64

Timestamp when the case was resolved in epoch milliseconds

Example:1708950896000

xdr_urlstring

URL to view the case in the Cortex console

Example:"https://your-fqdn.xdr.us.paloaltonetworks.com/incident-view?caseId=834"

starredboolean

Indicates if the case is starred

hostsarray[string]

List of hosts associated with the case in format 'OS_TYPE:hostname'

Example:["AGENT_OS_WINDOWS:host-1"]

usersarray[string]

List of users associated with the case

Example:["admin"]

aggregated_scoreinteger

Combined/aggregated score assigned to the case

Example:85

wildfire_hitsinteger

Number of WildFire hits

mitre_tactics_ids_and_namesarray[string]

List of MITRE ATT&CK tactics IDs and names

Example:["TA0004 - Privilege Escalation"]

mitre_techniques_ids_and_namesarray[string]

List of MITRE ATT&CK techniques IDs and names

Example:["T1068 - Exploitation for Privilege Escalation"]

issue_categoriesarray[string]

List of issue categories in the case

Example:["Privilege Escalation"]

tagsarray[string]

List of tags associated with the case

Example:["DS:PANW/XSIAM Manual","DOM:Security"]

custom_fieldsobject

Custom fields for additional metadata

Free-Form object

asset_idsarray[string]

List of asset IDs associated with the case

assetsarray

List of asset objects associated with the case

[

asset_idstring

Unique identifier for the asset

Example:"a8d24e796ef264a33e6e84c707ff2f67"

asset_namestring

Name of the asset

Example:"systest-uai-instance-itnc"

asset_typestring

Type of the asset

Example:"EC2 Instance"

asset_regionstring

Cloud region where the asset is located

Example:"us-east-1"

asset_group_idsarray[integer]

List of asset group IDs

Example:[1,5,7]

asset_providerstring

Cloud provider

Example:"AWS"

asset_accountstring

Cloud account identifier

Example:"195898722190"

asset_categorystring

Category of the asset

Example:"VM Instance"

asset_cloud_account_namestring

Cloud account name

Example:"195898722190"

asset_external_provider_idstring

External provider ID for the asset

]

case_domainstring

Domain associated with the case

Example:"Security"

issue_idsarray[integer]

List of issue IDs associated with the case

Example:[890]

file_artifact_idsobject

File artifact IDs associated with the case

DATAarray[string]

List of file artifact hash IDs

TOTAL_COUNTinteger

Total count of file artifacts

network_artifact_idsobject

Network artifact IDs associated with the case

DATAarray[string]

List of network artifact IDs

TOTAL_COUNTinteger

Total count of network artifacts

]

RESPONSE
{
  "reply": {
    "TOTAL_COUNT": 0,
    "FILTER_COUNT": 0,
    "DATA": [
      {
        "case_id": 834,
        "is_blocked": false,
        "case_name": "Windows Installer exploitation for local privilege escalation",
        "creation_time": 1776902615000,
        "modification_time": 1776902615000,
        "status_progress": "Resolved",
        "resolve_reason": "Resolved - Other",
        "severity": "high",
        "description": "Reduce risk from the listed configuration issues through the primary AWS asset.",
        "assigned_user_mail": "user@example.com",
        "assigned_user_pretty_name": "Jane Smith",
        "issue_count": 1,
        "user_severity": "medium",
        "notes": "Investigation complete, no further action needed.",
        "low_severity_issue_count": 0,
        "med_severity_issue_count": 0,
        "high_severity_issue_count": 1,
        "critical_severity_issue_count": 0,
        "user_count": 0,
        "host_count": 1,
        "resolve_comment": "Resolved via public API.",
        "resolved_timestamp": 1708950896000,
        "xdr_url": "https://your-fqdn.xdr.us.paloaltonetworks.com/incident-view?caseId=834",
        "starred": false,
        "hosts": [
          "AGENT_OS_WINDOWS:host-1"
        ],
        "users": [
          "admin"
        ],
        "aggregated_score": 85,
        "wildfire_hits": 0,
        "mitre_tactics_ids_and_names": [
          "TA0004 - Privilege Escalation"
        ],
        "mitre_techniques_ids_and_names": [
          "T1068 - Exploitation for Privilege Escalation"
        ],
        "issue_categories": [
          "Privilege Escalation"
        ],
        "tags": [
          "DS:PANW/XSIAM Manual",
          "DOM:Security"
        ],
        "custom_fields": {},
        "asset_ids": [
          "example"
        ],
        "assets": [
          {
            "asset_id": "a8d24e796ef264a33e6e84c707ff2f67",
            "asset_name": "systest-uai-instance-itnc",
            "asset_type": "EC2 Instance",
            "asset_region": "us-east-1",
            "asset_group_ids": [
              1,
              5,
              7
            ],
            "asset_provider": "AWS",
            "asset_account": "195898722190",
            "asset_category": "VM Instance",
            "asset_cloud_account_name": "195898722190",
            "asset_external_provider_id": "example"
          }
        ],
        "case_domain": "Security",
        "issue_ids": [
          890
        ],
        "file_artifact_ids": {
          "DATA": [
            "e872623cc49d1c5cdce7c1ff4c481153"
          ],
          "TOTAL_COUNT": 1
        },
        "network_artifact_ids": {
          "DATA": [],
          "TOTAL_COUNT": 0
        }
      }
    ]
  }
}

Bad request

Body

application/json

errorstring

Example:"Invalid request data"

RESPONSE
{
  "error": "Invalid request data"
}

Unauthorized access

Body

application/json

errorstring

Example:"Unauthorized request"

RESPONSE
{
  "error": "Unauthorized request"
}

Internal server error

Body

application/json

errorstring

Example:"Internal server error"

RESPONSE
{
  "error": "Internal server error"
}