Get a single alert or list of alerts with multiple events. - Response is concatenated using AND condition (OR is not supported). - Maximum result set size is 100. - Offset is the zero-based number of alerts from the start of the result set.
Note: You can send a request to retrieve all or filtered results.
Required license: Cortex Xpanse Expander
curl -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" -H "authorization: authorization_example" -H "x-xdr-auth-id: xXdrAuthId_example" \
"https://api-yourfqdn/public_api/v2/alerts/get_alerts_multi_events" \
-d '{
"request_data" : {
"search_from" : 0,
"next_page_token" : "next_page_token",
"filters" : [ {
"field" : "field",
"value" : [ "", "" ],
"operator" : "operator"
}, {
"field" : "field",
"value" : [ "", "" ],
"operator" : "operator"
} ],
"sort" : {
"field" : "field",
"keyword" : "keyword"
},
"search_to" : 6,
"use_page_token" : true
}
}'
authorization_example
xXdrAuthId_example
{"request_data":{}}
A dictionary containing the API request fields.
An empty dictionary returns all results.
Identifies the alert fields the filter is matching. Possible values are:
- alert_id_list— List of integers representing Alert IDs. Use this filter to request a single alert.
- alert_source
- business_units_list
- cloud_management_status
- creation_time
- external_id_list
- severity
- status
- tags
- xpanse_policy_id— Matches on the specified xpanse policy IDs. Xpanse policies are referred to as attack surface rules in the Expander UI.
String that identifies the comparison operator you want to use for this filter. Possible values:
- in— use with
alert_id_list,alert_source,business_units_list,cloud_management_status,tags,xpanse_policy_id, andseverity. - gte/lte— use with
creation_timeonly
Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter:
- alert_id_list— List of integers. Each item in the list must be an alert ID.
- alert_source— List of strings.
- business_units_list— String or list of strings in the format "BU name" or "BU:BU name", for example “Acme & Co, Inc.” or “BU:Acme & Co, Inc.”
- cloud_management_status— String. Values are
Managed Cloud,Unmanaged Cloud, andNot Applicable. - creation_time— Integer representing the number of seconds or milliseconds after the Unix epoch, UTC timezone. The value is returned in the response under the detection_timestamp field and represented in the console under the TIMESTAMP field.
- external_id_list— List of strings representing external IDs.
- severity— Valid values:
low,medium,high,critical,informational - status— Valid values:
new,resolved_no_risk,resolved_risk_accepted,resolved_no_longer_observed,resolved_contested_asset,resolved_remediated_automatically,resolved,under_investigation. - tags— List of strings indicating the tags to filter on in the format
"tag-family:tag-name", for example"AR:registered to you". - xpanse_policy_id— List of strings representing the xpanse policy IDs.
An integer representing the starting offset within the query result set from which you want alerts returned.
Alerts are returned as a zero-based list. Any alert indexed less than this value is not returned in the final result set and defaults to zero.
An integer representing the end offset within the result set after which you do not want alerts returned.
Alerts in the alerts list that are indexed higher than this value are not returned in the final results set. Defaults to 100, which returns all alerts to the end of the list. Use this field to specify the number of results on a page when using page token pagination.
Max value - 100
severity or creation_time.
"use_page_token":true in the initial request to paginate the response data.
Sort is not supported when using the use_page_token/next_page_token fields.
"use_page_token":true was included in the initial request, the response for that request will include a page token. Use "next_page_token":"string" to pass that page token into the next request to paginate the next set of data.
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.