Supported Filter Fields & Values

Field	Operator	Value Type	Example / Allowed Values
`id`	`in`	Array of integers	`[123, 456, 789]`
`external_id`	`in`	Array of strings	`["abc-12345-def", "ext-67890"]`
`detection.method`	`in`	Array of strings	["XDR Agent", "XDR Analytics", "PAN NGFW", "XDR BIOC", "XDR IOC", "Threat Intelligence", "Correlation", "Prisma Cloud", "Prisma Cloud Compute", "ASM", "IoT Security", "Custom Issue", "Health", "Attack Path", "Posture Policy", "CSPM Scanner", "CAS CVE Scanner", "CAS Drift Scanner", "IaC Scanner", "CAS Secret Scanner", "CI/CD Risks", "CLI Scanner", "CIEM Scanner", "Agentless Disk Scanner", "Kubernetes Scanner", "Compute Policy", "Secrets Scanner", "SAST Scanner", "Data Policy", "Vulnerability Policy", "AI Security Posture", "DLP", "Graph Engine", "API Traffic Monitor", "API Posture Scanner"]
`issue_domain`	`in`	Array of strings	Default domains: `["Security", "Health", "Hunting", "IT", "Posture"]`. Custom domains may also be configured per tenant.
`severity`	`in`	Array of strings	Allowed: `["INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL"]`
`_insert_time`	`gte`, `lte`	Integer (epoch ms)	`1700000000000`
`last_modified`	`gte`, `lte`	Integer (epoch ms)	`1700000000000`
`observation_time`	`gte`, `lte`	Integer (epoch ms)	`1700000000000`
`status.progress`	`in`	Array of strings	Allowed: `["New", "In Progress", "Resolved"]`
`assigned_to`	`in`	Array of strings	Email addresses, e.g. `["alice@example.com"]`
`assigned_to_pretty`	`in`	Array of strings	Display names, e.g. `["Alice Smith"]`

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.

Request headers

Authorization String required

{api_key}

Example: authorization_example

x-xdr-auth-id String required

{api_key_id}

Example: xXdrAuthId_example

CLIENT REQUEST

          curl -X 'POST'

        -H
        'Accept: application/json'
      
        -H
        'Content-Type: application/json'
      
          -H
          'Authorization: authorization_example'
          -H
          'x-xdr-auth-id: xXdrAuthId_example'
      
      'https://api-yourfqdn/public_api/v1/issue/search'
    
      -d
      ''

import http.client

conn = http.client.HTTPSConnection("api-yourfqdn")

payload = "{\"request_data\":{\"filters\":[{\"field\":\"id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"id\",\"keyword\":\"asc\"},\"include_fields\":[]}}"

headers = {
    'Authorization': "SOME_STRING_VALUE",
    'x-xdr-auth-id': "SOME_STRING_VALUE",
    'content-type': "application/json"
    }

conn.request("POST", "/public_api/v1/issue/search", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))

require 'uri'
require 'net/http'
require 'openssl'

url = URI("https://api-yourfqdn/public_api/v1/issue/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'SOME_STRING_VALUE'
request["x-xdr-auth-id"] = 'SOME_STRING_VALUE'
request["content-type"] = 'application/json'
request.body = "{\"request_data\":{\"filters\":[{\"field\":\"id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"id\",\"keyword\":\"asc\"},\"include_fields\":[]}}"

response = http.request(request)
puts response.read_body

const data = JSON.stringify({
  "request_data": {
    "filters": [
      {
        "field": "id",
        "operator": "in",
        "value": [
          0
        ]
      }
    ],
    "search_from": 0,
    "search_to": 100,
    "sort": {
      "field": "id",
      "keyword": "asc"
    },
    "include_fields": []
  }
});

const xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function () {
  if (this.readyState === this.DONE) {
    console.log(this.responseText);
  }
});

xhr.open("POST", "https://api-yourfqdn/public_api/v1/issue/search");
xhr.setRequestHeader("Authorization", "SOME_STRING_VALUE");
xhr.setRequestHeader("x-xdr-auth-id", "SOME_STRING_VALUE");
xhr.setRequestHeader("content-type", "application/json");

xhr.send(data);

HttpResponse<String> response = Unirest.post("https://api-yourfqdn/public_api/v1/issue/search")
  .header("Authorization", "SOME_STRING_VALUE")
  .header("x-xdr-auth-id", "SOME_STRING_VALUE")
  .header("content-type", "application/json")
  .body("{\"request_data\":{\"filters\":[{\"field\":\"id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"id\",\"keyword\":\"asc\"},\"include_fields\":[]}}")
  .asString();

import Foundation

let headers = [
  "Authorization": "SOME_STRING_VALUE",
  "x-xdr-auth-id": "SOME_STRING_VALUE",
  "content-type": "application/json"
]
let parameters = ["request_data": [
    "filters": [
      [
        "field": "id",
        "operator": "in",
        "value": [0]
      ]
    ],
    "search_from": 0,
    "search_to": 100,
    "sort": [
      "field": "id",
      "keyword": "asc"
    ],
    "include_fields": []
  ]] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api-yourfqdn/public_api/v1/issue/search")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-yourfqdn/public_api/v1/issue/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "{\"request_data\":{\"filters\":[{\"field\":\"id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"id\",\"keyword\":\"asc\"},\"include_fields\":[]}}",
  CURLOPT_HTTPHEADER => [
    "Authorization: SOME_STRING_VALUE",
    "content-type: application/json",
    "x-xdr-auth-id: SOME_STRING_VALUE"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_URL, "https://api-yourfqdn/public_api/v1/issue/search");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "Authorization: SOME_STRING_VALUE");
headers = curl_slist_append(headers, "x-xdr-auth-id: SOME_STRING_VALUE");
headers = curl_slist_append(headers, "content-type: application/json");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{\"request_data\":{\"filters\":[{\"field\":\"id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"id\",\"keyword\":\"asc\"},\"include_fields\":[]}}");

CURLcode ret = curl_easy_perform(hnd);

var client = new RestClient("https://api-yourfqdn/public_api/v1/issue/search");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("x-xdr-auth-id", "SOME_STRING_VALUE");
request.AddHeader("content-type", "application/json");
request.AddParameter("application/json", "{\"request_data\":{\"filters\":[{\"field\":\"id\",\"operator\":\"in\",\"value\":[0]}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"id\",\"keyword\":\"asc\"},\"include_fields\":[]}}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

Body parameters

required

application/json

request_dataobject

filtersarray

[

fieldstring (Enum)

Specifies the field to filter issues by. See the endpoint description above for allowed values per field.

Allowed values:"id""external_id""detection.method""issue_domain""severity""_insert_time""last_modified""status.progress""assigned_to""assigned_to_pretty""observation_time""category""detection.rule_id""asset_ids""asset_names""asset_classes""asset_group_ids""asset_categories""asset_regions""asset_providers""asset_accounts""asset_types""asset_external_provider_ids""asset_cloud_account_names"

operatorstring (Enum)

Comparison operator to use with the filter. Note: gte and lte are only valid for time-based fields (_insert_time, last_modified, observation_time). All other fields support in.

Allowed values:"in""gte""lte"

valueobject

Value(s) for filtering the issues. Allowed values depend on the selected field:

severity: INFO, LOW, MEDIUM, HIGH, CRITICAL
status.progress: New, In Progress, Resolved
issue_domain: Security, Health, Hunting, IT, Posture (custom domains may also be configured)
detection.method: XDR Agent, XDR Analytics, PAN NGFW, XDR BIOC, XDR IOC, Threat Intelligence, XDR Managed Threat Hunting, XDR Analytics BIOC, Correlation, Prisma Cloud, Prisma Cloud Compute, ASM, IoT Security, Custom Issue, Health, SaaS Attachments, Attack Path, Posture Policy, CAS Drift Scanner, Cloud Network Analyzer, IaC Scanner, CAS Secret Scanner, CI/CD Risks, CLI Scanner, CIEM Scanner, API Traffic Monitor, API Posture Scanner, Agentless Disk Scanner, Kubernetes Scanner, Compute Policy, CSPM Scanner, CAS CVE Scanner, CAS License Scanner, Secrets Scanner, SAST Scanner, Data Policy, Package Operational Risk, Vulnerability Policy, AI Security Posture, DLP, MIRRORING, AURL, User Reported Phishing, Graph Engine
category: CONFIGURATION, VULNERABILITY, MALWARE, IDENTITY, NETWORK, DATA_LOSS, COMPLIANCE, RUNTIME, SECRETS, IAC, CI_CD_RISKS, DRIFT, API_SECURITY, POSTURE, COMPUTE, LICENSE, OPERATIONAL_RISK, AI_SECURITY
asset_classes: Compute, Data, Network, Identity, Security, Management, Application, Other
asset_categories: Storage Bucket, Virtual Machine, Database Instance, Container, Serverless Function, Load Balancer, Firewall, VPN Gateway, IAM Role, IAM User, IAM Group, IAM Policy, Service Account, Kubernetes Cluster, Kubernetes Pod, Kubernetes Node, Network Interface, Subnet, VPC, Security Group, DNS Zone, Certificate, Key Vault, Disk, Snapshot, Image, Queue, Topic, API Gateway, CDN, Other
asset_providers: AWS, Azure, GCP, Oracle Cloud, IBM Cloud, Alibaba Cloud, Other
_insert_time, last_modified, observation_time: Epoch timestamp in milliseconds (integer)
id: Integer issue ID
external_id, detection.rule_id, assigned_to, assigned_to_pretty, asset_ids, asset_names, asset_accounts, asset_regions, asset_types, asset_group_ids, asset_external_provider_ids, asset_cloud_account_names: Free-text string values

One of

Array

integer

Value(s) for filtering the issues. Allowed values depend on the selected field:

severity: INFO, LOW, MEDIUM, HIGH, CRITICAL
status.progress: New, In Progress, Resolved
issue_domain: Security, Health, Hunting, IT, Posture (custom domains may also be configured)
detection.method: XDR Agent, XDR Analytics, PAN NGFW, XDR BIOC, XDR IOC, Threat Intelligence, XDR Managed Threat Hunting, XDR Analytics BIOC, Correlation, Prisma Cloud, Prisma Cloud Compute, ASM, IoT Security, Custom Issue, Health, SaaS Attachments, Attack Path, Posture Policy, CAS Drift Scanner, Cloud Network Analyzer, IaC Scanner, CAS Secret Scanner, CI/CD Risks, CLI Scanner, CIEM Scanner, API Traffic Monitor, API Posture Scanner, Agentless Disk Scanner, Kubernetes Scanner, Compute Policy, CSPM Scanner, CAS CVE Scanner, CAS License Scanner, Secrets Scanner, SAST Scanner, Data Policy, Package Operational Risk, Vulnerability Policy, AI Security Posture, DLP, MIRRORING, AURL, User Reported Phishing, Graph Engine
category: CONFIGURATION, VULNERABILITY, MALWARE, IDENTITY, NETWORK, DATA_LOSS, COMPLIANCE, RUNTIME, SECRETS, IAC, CI_CD_RISKS, DRIFT, API_SECURITY, POSTURE, COMPUTE, LICENSE, OPERATIONAL_RISK, AI_SECURITY
asset_classes: Compute, Data, Network, Identity, Security, Management, Application, Other
asset_categories: Storage Bucket, Virtual Machine, Database Instance, Container, Serverless Function, Load Balancer, Firewall, VPN Gateway, IAM Role, IAM User, IAM Group, IAM Policy, Service Account, Kubernetes Cluster, Kubernetes Pod, Kubernetes Node, Network Interface, Subnet, VPC, Security Group, DNS Zone, Certificate, Key Vault, Disk, Snapshot, Image, Queue, Topic, API Gateway, CDN, Other
asset_providers: AWS, Azure, GCP, Oracle Cloud, IBM Cloud, Alibaba Cloud, Other
_insert_time, last_modified, observation_time: Epoch timestamp in milliseconds (integer)
id: Integer issue ID
external_id, detection.rule_id, assigned_to, assigned_to_pretty, asset_ids, asset_names, asset_accounts, asset_regions, asset_types, asset_group_ids, asset_external_provider_ids, asset_cloud_account_names: Free-text string values

string

Value(s) for filtering the issues. Allowed values depend on the selected field:

severity: INFO, LOW, MEDIUM, HIGH, CRITICAL
status.progress: New, In Progress, Resolved
issue_domain: Security, Health, Hunting, IT, Posture (custom domains may also be configured)
detection.method: XDR Agent, XDR Analytics, PAN NGFW, XDR BIOC, XDR IOC, Threat Intelligence, XDR Managed Threat Hunting, XDR Analytics BIOC, Correlation, Prisma Cloud, Prisma Cloud Compute, ASM, IoT Security, Custom Issue, Health, SaaS Attachments, Attack Path, Posture Policy, CAS Drift Scanner, Cloud Network Analyzer, IaC Scanner, CAS Secret Scanner, CI/CD Risks, CLI Scanner, CIEM Scanner, API Traffic Monitor, API Posture Scanner, Agentless Disk Scanner, Kubernetes Scanner, Compute Policy, CSPM Scanner, CAS CVE Scanner, CAS License Scanner, Secrets Scanner, SAST Scanner, Data Policy, Package Operational Risk, Vulnerability Policy, AI Security Posture, DLP, MIRRORING, AURL, User Reported Phishing, Graph Engine
category: CONFIGURATION, VULNERABILITY, MALWARE, IDENTITY, NETWORK, DATA_LOSS, COMPLIANCE, RUNTIME, SECRETS, IAC, CI_CD_RISKS, DRIFT, API_SECURITY, POSTURE, COMPUTE, LICENSE, OPERATIONAL_RISK, AI_SECURITY
asset_classes: Compute, Data, Network, Identity, Security, Management, Application, Other
asset_categories: Storage Bucket, Virtual Machine, Database Instance, Container, Serverless Function, Load Balancer, Firewall, VPN Gateway, IAM Role, IAM User, IAM Group, IAM Policy, Service Account, Kubernetes Cluster, Kubernetes Pod, Kubernetes Node, Network Interface, Subnet, VPC, Security Group, DNS Zone, Certificate, Key Vault, Disk, Snapshot, Image, Queue, Topic, API Gateway, CDN, Other
asset_providers: AWS, Azure, GCP, Oracle Cloud, IBM Cloud, Alibaba Cloud, Other
_insert_time, last_modified, observation_time: Epoch timestamp in milliseconds (integer)
id: Integer issue ID
external_id, detection.rule_id, assigned_to, assigned_to_pretty, asset_ids, asset_names, asset_accounts, asset_regions, asset_types, asset_group_ids, asset_external_provider_ids, asset_cloud_account_names: Free-text string values

]

search_frominteger

Starting index for pagination.

search_tointeger

Ending index for pagination.

Default:100

sortobject

fieldstring (Enum)

Allowed values:"id""severity""observation_time"

keywordstring (Enum)

Sort order (ascending or descending).

Allowed values:"asc""desc"

include_fieldsarray[string]

A list of fields to include in the response.

normalized_fields: Includes normalized fields in the response.
custom_fields: Includes custom user-defined fields in the response.
By default these fields will not be part of response payload.

REQUEST

{
  "request_data": {
    "filters": [
      {
        "field": "severity",
        "operator": "in",
        "value": [
          "HIGH",
          "CRITICAL"
        ]
      }
    ]
  },
  "search_from": 0,
  "search_to": 50,
  "sort": {
    "field": "observation_time",
    "keyword": "desc"
  }
}

{
  "request_data": {
    "filters": [
      {
        "field": "_insert_time",
        "operator": "gte",
        "value": 1700000000000
      },
      {
        "field": "_insert_time",
        "operator": "lte",
        "value": 1700100000000
      }
    ]
  },
  "search_from": 0,
  "search_to": 100
}

{
  "request_data": {
    "filters": [
      {
        "field": "status.progress",
        "operator": "in",
        "value": [
          "New"
        ]
      },
      {
        "field": "issue_domain",
        "operator": "in",
        "value": [
          "Security"
        ]
      }
    ]
  },
  "search_from": 0,
  "search_to": 100,
  "include_fields": [
    "normalized_fields",
    "custom_fields"
  ]
}

{
  "request_data": {
    "filters": [
      {
        "field": "id",
        "operator": "in",
        "value": [
          123,
          456,
          789
        ]
      }
    ]
  }
}

{
  "request_data": {
    "filters": [
      {
        "field": "detection.method",
        "operator": "in",
        "value": [
          "CSPM_SCANNER",
          "CREATE_ALERT_PUBLIC_API"
        ]
      }
    ]
  },
  "sort": {
    "field": "severity",
    "keyword": "desc"
  }
}

{
  "request_data": {
    "filters": [
      {
        "field": "asset_names",
        "operator": "in",
        "value": [
          "my-server-01",
          "my-database-prod"
        ]
      },
      {
        "field": "asset_accounts",
        "operator": "in",
        "value": [
          "883588134481"
        ]
      }
    ]
  }
}

Responses

Successful response with issues

Body

application/json

replyobject

TOTAL_COUNTinteger

FILTER_COUNTinteger

DATAarray

[

_insert_timeintegerint64

Issue creation timestamp in epoch milliseconds.

Example:1705312200000

external_idstring

Example:"EXT-12345"

namestring

Example:"Suspicious Network Activity"

descriptionstring

Example:"Unusual outbound traffic detected from internal server"

observation_timeintegerint64

Example:1621234567890

domainstring (Enum)

Issue domain. Default domains listed below; custom domains may also be configured per tenant.

Example:"Security"

Allowed values:"Security""Health""Hunting""IT""Posture"

detection.methodstring (Enum)

Detection source or method that created the issue.

Example:"BIOC"

Allowed values:"TRAPS""MAGNIFIER""ANALYTICS_BIOC""FW""BIOC""IOC""THREAT_INTELLIGENCE""MTH""CORRELATION""PRISMA_CLOUD""PRISMA_CLOUD_COMPUTE""XPANSE""IOT""CREATE_ALERT_PUBLIC_API""HEALTH""EMAIL_ATTACHMENT""ATTACK_PATH""POSTURE_POLICY""CAS_DRIFT_SCANNER""CLOUD_NETWORK_ANALYZER""CAS_IAC_SCANNER""CAS_SECRET_SCANNER""CAS_CI_CD_RISK_SCANNER""CLI_SCANNER""CIEM_SCANNER""API_TRAFFIC_MONITOR""API_POSTURE_SCANNER""AGENTLESS_DISK_SCANNER""KUBERNETES_SCANNER""COMPUTE_POLICY""CSPM_SCANNER""CAS_CVE_SCANNER""CAS_LICENSE_SCANNER""SECRETS_SCANNER""CAS_SAST_SCANNER""DATA_POLICY""CAS_OPERATIONAL_RISK_SCANNER""VULNERABILITY_POLICY""AISPM_RULE_ENGINE""DLP""MIRRORING""AURL""USER_REPORTED_PHISHING""GRAPH_ENGINE"

detection.rule_idstring

Example:"RULE-9876"

categorystring (Enum)

Issue category classification.

Example:"CONFIGURATION"

Allowed values:"CONFIGURATION""VULNERABILITY""MALWARE""IDENTITY""NETWORK""DATA_LOSS""COMPLIANCE""RUNTIME""SECRETS""IAC""CI_CD_RISKS""DRIFT""API_SECURITY""POSTURE""COMPUTE""LICENSE""OPERATIONAL_RISK""AI_SECURITY"

findingsarray[string]

Example:["013543ea00ea9893bcde59cbfdc5992f"]

asset_idsarray[string]

asset_namesarray[string]

Example:["pc-national-bank-sales-data-532ctl"]

asset_group_idsarray[integer]

Example:[5,7,11,42,45,131]

asset_classesarray[string]

Example:["Data","Compute"]

asset_categoriesarray[string]

Example:["Storage Bucket","Virtual Machine","Database Instance"]

asset_regionsarray[string]

Cloud regions where the assets are located. Values depend on the cloud provider (e.g., AWS: us-east-1, Azure: eastus, GCP: us-central1).

Example:["us-east-1","us-west-2","eu-central-1"]

asset_providersarray[string]

Example:["AWS","Azure","GCP","Oracle Cloud","IBM Cloud"]

asset_accountsarray[string]

Example:["883588134481"]

asset_typesarray[string]

Example:["Virtual Machine","Storage Bucket"]

mitre_tacticsarray[string]

Example:["TA0004 - Privilege Escalation"]

mitre_techniquesarray[string]

Example:["T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching"]

typestring

Example:"Identity Security"

remediationstring

Example:"Isolate affected system and investigate traffic patterns"

extended_descriptionstring

Example:"Detailed analysis of the network traffic patterns and potential impact"

impactstring

Example:"Potential data exfiltration or command and control activity"

idinteger

Internal numeric ID of the issue.

Example:123

last_update_timestampintegerint64

Example:1621235678901

tagsarray[string]

Example:["critical","investigation_required"]

is_excludedboolean

is_starredboolean

Example:true

assigned_tostring

Example:"alice.smith@example.com"

assigned_to_prettystring

Example:"Alice Smith"

status.progressstring (Enum)

Current status of the issue. Built-in values are 'New', 'In Progress', and 'Resolved'. Additional custom statuses may be configured per tenant.

Example:"Resolved"

Allowed values:"New""In Progress""Resolved"

status.resolution_reasonstring (Enum)

Resolution reason for resolved issues. Null when issue is not resolved. Built-in values are listed below. Additional values may be available depending on tenant configuration.

Example:"RESOLVED_OTHER"

Allowed values:"RESOLVED_THREAT_HANDLED""RESOLVED_KNOWN_ISSUE""RESOLVED_DUPLICATE""RESOLVED_FALSE_POSITIVE""RESOLVED_OTHER""RESOLVED_TRUE_POSITIVE""RESOLVED_SECURITY_TESTING""RESOLVED_RISK_ACCEPTED""RESOLVED_FIXED""RESOLVED_DISMISSED""RESOLVED_AUTO_RESOLVE"

status.resolution_commentstring

Free-text comment provided when resolving the issue. Null when the issue is not resolved or no comment was provided.

Example:"Investigating the source of suspicious traffic"

severitystring (Enum)

Example:"HIGH"

Allowed values:"INFO""LOW""MEDIUM""HIGH""CRITICAL"

resolution_status_modified_tsintegerint64

Epoch timestamp in milliseconds when the resolution status was last modified.

Example:1621240000000

case_idsarray[integer]

List of case IDs this issue is associated with.

Example:[3,42]

initial_evidencestring

Initial evidence that triggered the issue.

Example:"Security group sg-12345 allows inbound TCP/5432 from 0.0.0.0/0"

is_exceptedboolean

Indicates if the issue has an active exception.

exception_idsarray[string]

List of exception IDs applied to this issue.

exception_expirationintegerint64

Epoch timestamp in milliseconds when the exception expires.

agentic_response_statusstring

Status of the agentic response for this issue.

agentic_assistant_idstring

ID of the agentic assistant handling this issue.

agentic_response_conversation_idstring

Conversation ID for the agentic response.

action_statusstring

Current action status of the issue.

Example:"SCANNED"

asset_external_provider_idsarray[string]

List of external provider IDs for assets associated with the issue.

asset_cloud_account_namesarray[string]

List of cloud account names for assets associated with the issue.

normalized_fieldsobject

xdm.source.location.countryarray[string]

Example:["US"]

xdm.source.ipv4array[string]

Example:["192.168.1.1"]

xdm.source.host.ipv4_addressesarray[string]

Example:["192.168.1.2","192.168.1.3"]

xdm.source.identity.usernamearray[string]

Example:["admin"]

xdm.source.process.causality_idarray[string]

Example:["abc123"]

xdm.source.process.command_linearray[string]

Example:["/usr/bin/process -arg1 -arg2"]

xdm.source.process.executable.filenamestring

Example:"process_executable"

xdm.source.process.namearray[string]

Example:["process_name"]

xdm.source.process.executable.patharray[string]

Example:["/usr/bin/process_executable"]

xdm.source.process.executable.sha256array[string]

Example:["f9c7b6e24f7e93d8d3e5c76f8b1b88cd8f17b34a7a4a2e3d5b2dbf09f5b8fdc2"]

xdm.source.host.hostnamestring

Example:"hostname1"

xdm.source.host.os_familystring

Example:"Linux"

xdm.source.agent.identifierstring

Example:"agent123"

xdm.source.agent.installation_idstring

Example:"installation123"

xdm.source.host.fqdnstring

Example:"hostname1.domain.com"

xdm.source.process.executable.signature_statusarray[string]

Example:["SIGNATURE_UNAVAILABLE"]

xdm.target.file.filenamearray[string]

Example:["target_file.txt"]

xdm.target.module.filenamestring

Example:"target_module.so"

xdm.target.file.sha256array[string]

Example:["d4bfc6fabe8d6d1b76e5b441dc8d01758276281f56c929b282ac5c3ee704c431"]

xdm.target.module.sha256string

Example:"7f4eafdad74bfedabf370a3725a5077c"

xdm.target.process.command_linearray[string]

Example:["/usr/bin/target_process -option"]

xdm.target.process.executable.sha256array[string]

Example:["7b21d50d6270f95b5a2cf582bf94b315cd75a034dd9478c0e5b4089bbd9b59ac"]

xdm.target.process.executable.signature_statusarray[string]

Example:["SIGNATURE_UNAVAILABLE"]

xdm.target.process.executable.signerarray[string]

xdm.target.process.executable.patharray[string]

xdm.target.ipv4array[string]

xdm.target.host.ipv4_addressesarray[string]

Example:["10.0.0.2","10.0.0.3"]

xdm.target.host.ipv6_addressesarray[string]

xdm.target.ipv6array[string]

Example:["10.0.0.2","10.0.0.3"]

xdm.target.portarray[integer]

Example:[8080]

xdm.target.location.countrystring

Example:"US"

xdm.target.host.hostnamestring

Example:"hostname"

xdm.target.identity.usernamestring

Example:"user1"

xdm.target.urlstring

Example:"https://example.com"

xdm.target.process.executable.filenamearray[string]

Example:["target_process"]

xdm.target.process.namestring

Example:"target_process"

xdm.target.agent.identifierstring

Example:"target_agent"

xdm.target.registry.valuearray[string]

Example:["registry_value"]

xdm.target.registry.dataarray[string]

Example:["registry_data"]

xdm.target.registry.keyarray[string]

Example:["registry_key"]

xdm.email.attachment.sha256string

Example:"a1b2c3d4e5f6789abcde1234567890f2"

xdm.email.attachment.filenamestring

Example:"attachment.pdf"

xdm.email.senderstring

Example:"sender@example.com"

xdm.event.typestring

Example:"Intrusion"

xdm.cloud.providerstring

Example:"AWS"

xdm.cloud.projectstring

Example:"CloudProject1"

xdm.cloud.project_idstring

Example:"cloud_project_id_123"

xdm.cloud.regionstring

Example:"us-east-1"

xdm.cloud.function.idstring

Example:"cloud_func_123"

xdm.cloud.function.namestring

Example:"cloud_function"

xdm.cloud.function.versionstring

Example:"v1.0.0"

xdm.cloud.function.request_idstring

Example:"req_123"

xdm.cloud.function.runtimestring

Example:"nodejs"

xdm.observer.unique_identifierstring

Example:"observer123"

xdm.observer.typestring

Example:"Server"

xdm.observer.sub_typestring

Example:"Linux"

xdm.observer.namestring

Example:"Observer 1"

xdm.vulnerability.cve_idstring

Example:"CVE-2021-12345"

xdm.vulnerability.severitystring (Enum)

Example:"HIGH"

Allowed values:"INFO""LOW""MEDIUM""HIGH""CRITICAL"

xdm.vulnerability.fix_versionsarray[string]

Example:["1.0.1","1.0.2"]

xdm.vulnerability.cve_risk_factorsarray[string]

Example:["Exploitability","Impact"]

xdm.vulnerability.cvss_scorenumberfloat

Example:7.8

xdm.vulnerability.cvss_vectorstring

Example:"AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

xdm.software_package.versionstring

Example:"1.0.0"

xdm.software_package.purlstring

Example:"pkg:maven/com.example/software@1.0.0"

xdm.software_package.layer_idstring

Example:"layer123"

xdm.software_package.typestring

Example:"Library"

xdm.software_package.installation_typestring

Example:"Automatic"

xdm.software_package.package_managerstring

Example:"npm"

xdm.software_package.dependency_typestring

Example:"Direct"

xdm.software_package.languagestring

Example:"JavaScript"

xdm.malware.verdictstring

Example:"Malicious"

xdm.malware.virus_total_linkstring

Example:"https://www.virustotal.com/gui/file/abcd1234"

xdm.malware.layer_idstring

Example:"malware_layer123"

xdm.secret.secret_typestring

Example:"API Key"

xdm.secret.unique_identifierstring

Example:"secret_id_123"

xdm.secret.snippetstring

Example:"API Key: 12345"

xdm.secret.layer_idstring

Example:"secret_layer123"

xdm.file.filenamestring

Example:"file.txt"

xdm.file.patharray[string]

Example:["/path/to/file.txt"]

xdm.file.sha256string

Example:"abc1234567890def0987654321"

xdm.file.sizeinteger

Example:1024

xdm.file.last_modifiedinteger

Example:1615465123

xdm.file.metadata_change_timeinteger

Example:1615465000

xdm.file.owner_idstring

Example:"user1"

xdm.file.owner_namestring

Example:"fileowner"

xdm.file.group_idstring

Example:"group1"

xdm.file.group_namestring

Example:"groupname"

xdm.file.permissions.ownerarray[string]

Example:["read","write"]

xdm.file.permissions.grouparray[string]

Example:["read"]

xdm.file.permissions.othersarray[string]

Example:["read"]

xdm.file.position.start.lineinteger

Example:1

xdm.file.position.start.characterinteger

xdm.file.position.end.lineinteger

Example:100

xdm.file.position.end.characterinteger

Example:80

xdm.urlstring

Example:"https://example.com"

xdm.domainstring

Example:"example.com"

xdm.application_protocolstring

Example:"HTTPS"

custom_fieldsobject

]

RESPONSE
{
  "reply": {
    "TOTAL_COUNT": 1500,
    "FILTER_COUNT": 2,
    "DATA": [
      {
        "_insert_time": 1705312200000,
        "external_id": "abc-12345-def",
        "name": "Publicly Exposed Storage Bucket",
        "description": "S3 bucket my-data-bucket is publicly accessible",
        "observation_time": 1705312200000,
        "domain": "Posture",
        "detection.method": "CSPM_SCANNER",
        "detection.rule_id": "RULE-S3-PUBLIC",
        "category": "CONFIGURATION",
        "findings": [
          "f1a2b3c4d5"
        ],
        "asset_ids": [
          "a8d24e796ef264a33e6e84c707ff2f67"
        ],
        "asset_names": [
          "my-data-bucket"
        ],
        "asset_group_ids": [
          5,
          42
        ],
        "asset_classes": [
          "Data"
        ],
        "asset_categories": [
          "Storage Bucket"
        ],
        "asset_regions": [
          "us-east-1"
        ],
        "asset_providers": [
          "AWS"
        ],
        "asset_accounts": [
          "883588134481"
        ],
        "asset_types": [
          "S3 Bucket"
        ],
        "mitre_tactics": [
          "TA0001 - Initial Access"
        ],
        "mitre_techniques": [
          "T1190 - Exploit Public-Facing Application"
        ],
        "type": "Posture",
        "remediation": "Restrict public access on the S3 bucket",
        "extended_description": "The bucket allows unauthenticated read access to all objects.",
        "impact": "Potential data exposure of sensitive customer records",
        "id": 12345,
        "last_update_timestamp": 1705315800000,
        "tags": [
          "critical",
          "data-exposure"
        ],
        "is_excluded": false,
        "is_starred": true,
        "assigned_to": "alice.smith@example.com",
        "assigned_to_pretty": "Alice Smith",
        "status.progress": "New",
        "severity": "HIGH",
        "case_ids": [
          834
        ],
        "is_excepted": false,
        "exception_ids": null,
        "exception_expiration": null,
        "initial_evidence": "Security group sg-12345 allows inbound TCP/5432 from 0.0.0.0/0",
        "asset_external_provider_ids": [],
        "asset_cloud_account_names": [],
        "action_status": "SCANNED",
        "agentic_response_status": null,
        "agentic_assistant_id": null,
        "agentic_response_conversation_id": null
      }
    ]
  }
}

Bad request

Body

application/json

errorstring

Example:"Invalid request data"

RESPONSE
{
  "error": "Invalid request data"
}

Unauthorized access

Body

application/json

errorstring

Example:"Unauthorized request"

RESPONSE
{
  "error": "Unauthorized request"
}

Internal server error

Body

application/json

errorstring

Example:"Internal server error"

RESPONSE
{
  "error": "Internal server error"
}