Get Incidents

post /public_api/v1/incidents/get_incidents/

Get details for a single incident or a list of incidents filtered by a list of severity or creation time. - The response is concatenated using AND condition (OR is not supported).
- The maximum result set size is >100.
- Offset is the zero-based number of incidents from the start of the result set.

Note: You can send a request to retrieve either all or filtered results.

Required license: Cortex Xpanse Expander

Request headers

authorization

String

required

api-key

Example: {{api_key}}

x-xdr-auth-id

String

required

api-key-id

Example: {{api_key_id}}

Body parameters

required

request_dataObject

A dictionary containing the API request fields. An empty dictionary returns all results.

filtersArray

Array of filter fields.

[

fieldString (Enum)

Identifies the incident field the filter is matching.

Allowed values:"modification_time""description""creation_time""alert_sources""incident_id_list""status""cloud_management_status""starred""incident_id""integration_source"

operatorString (Enum)

Identifies the comparison operator you want to use for this filter. Valid keywords are: - in: incident_id_list, alert_sources, cloud_management_status, description, integration_source - contains: description - gte / lte: modification_time, creation_time: Integer in timestamp epoch milliseconds - eq / nqe: status

Allowed values:"in""contains""neq""eq""lte""gte"

valueObject

Value that this filter must match. The contents of this field will differ depending on the incident field that you specified for this filter: - alert_sources: String - cloud_management_status: String. Values are Managed Cloud, Unmanaged Cloud, and Not Applicable. - creation_time:Integer in timestamp epoch milliseconds - description: String - incident_id_list: List of strings. Each item in the list must be an incident ID. - integration_source: List of strings. Valid values:AWS,AZURE,GOOGLE,PRISMA_CLOUD- modification_time:Integerin timestamp epoch milliseconds - status: Valid values:new,under_investigation,resolved`

]

search_fromInteger

Integer representing the starting offset within the query result set from which you want incidents returned. Incidents are returned as a zero-based list. Any incident indexed less than this value is not returned in the final result set and defaults to zero.

search_toInteger

Integer representing the end offset within the result set after which you do not want incidents returned. Incidents in the incident list that are indexed higher than this value are not returned in the final results set. Defaults to >100, which returns all incidents to the end of the list.

sortObject

Identifies the sort order for the result set. Default sort is defined as creation_time, DESC.

fieldString (Enum)

Can be creation_time or severity.

Allowed values:"creation_time""modification_time""incident_id"

keywordString (Enum)

Can either be ASC (ascending order) or DESC (descending order).

Allowed values:"ASC""asc""DESC""desc"

Free-Form object

REQUEST BODY

{
  "request_data": {
    "search_from": 0,
    "filters": [
      {
        "field": "modification_time",
        "value": "IncidentFilter_value",
        "operator": "in"
      },
      {
        "field": "modification_time",
        "value": "IncidentFilter_value",
        "operator": "in"
      }
    ],
    "sort": {
      "field": "modification_time",
      "keyword": "desc"
    },
    "search_to": 0
  }
}

CLIENT REQUEST

          curl -X 'POST'

        -H
        'Accept: application/json'
      

        -H
        'Content-Type: application/json'
      

          -H
          'authorization: {{api_key}}'
          -H
          'x-xdr-auth-id: {{api_key_id}}'
      

      'https://api-}/public_api/v1/incidents/get_incidents/'
    

      -d
      '{
  "request_data" : {
    "search_from" : 0,
    "filters" : [ {
      "field" : "modification_time",
      "value" : "IncidentFilter_value",
      "operator" : "in"
    }, {
      "field" : "modification_time",
      "value" : "IncidentFilter_value",
      "operator" : "in"
    } ],
    "sort" : {
      "field" : "modification_time",
      "keyword" : "desc"
    },
    "search_to" : 0
  }
}'
    


      

import http.client

conn = http.client.HTTPSConnection("api-")

payload = "{\"request_data\":{\"filters\":[{\"field\":\"modification_time\",\"operator\":\"in\",\"value\":\"string\"}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"creation_time\",\"keyword\":\"ASC\"}}}"

headers = {
    'authorization': "{{api_key}}",
    'x-xdr-auth-id': "{{api_key_id}}",
    'content-type': "application/json"
    }

conn.request("POST", "%7B%7Bfqdn%7D%7D/public_api/v1/incidents/get_incidents/", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))

require 'uri'
require 'net/http'
require 'openssl'

url = URI("https://api-/%7B%7Bfqdn%7D%7D/public_api/v1/incidents/get_incidents/")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

request = Net::HTTP::Post.new(url)
request["authorization"] = '{{api_key}}'
request["x-xdr-auth-id"] = '{{api_key_id}}'
request["content-type"] = 'application/json'
request.body = "{\"request_data\":{\"filters\":[{\"field\":\"modification_time\",\"operator\":\"in\",\"value\":\"string\"}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"creation_time\",\"keyword\":\"ASC\"}}}"

response = http.request(request)
puts response.read_body

const data = JSON.stringify({
  "request_data": {
    "filters": [
      {
        "field": "modification_time",
        "operator": "in",
        "value": "string"
      }
    ],
    "search_from": 0,
    "search_to": 100,
    "sort": {
      "field": "creation_time",
      "keyword": "ASC"
    }
  }
});

const xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function () {
  if (this.readyState === this.DONE) {
    console.log(this.responseText);
  }
});

xhr.open("POST", "https://api-/%7B%7Bfqdn%7D%7D/public_api/v1/incidents/get_incidents/");
xhr.setRequestHeader("authorization", "{{api_key}}");
xhr.setRequestHeader("x-xdr-auth-id", "{{api_key_id}}");
xhr.setRequestHeader("content-type", "application/json");

xhr.send(data);

HttpResponse<String> response = Unirest.post("https://api-/%7B%7Bfqdn%7D%7D/public_api/v1/incidents/get_incidents/")
  .header("authorization", "{{api_key}}")
  .header("x-xdr-auth-id", "{{api_key_id}}")
  .header("content-type", "application/json")
  .body("{\"request_data\":{\"filters\":[{\"field\":\"modification_time\",\"operator\":\"in\",\"value\":\"string\"}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"creation_time\",\"keyword\":\"ASC\"}}}")
  .asString();

import Foundation

let headers = [
  "authorization": "{{api_key}}",
  "x-xdr-auth-id": "{{api_key_id}}",
  "content-type": "application/json"
]
let parameters = ["request_data": [
    "filters": [
      [
        "field": "modification_time",
        "operator": "in",
        "value": "string"
      ]
    ],
    "search_from": 0,
    "search_to": 100,
    "sort": [
      "field": "creation_time",
      "keyword": "ASC"
    ]
  ]] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api-/%7B%7Bfqdn%7D%7D/public_api/v1/incidents/get_incidents/")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-/%7B%7Bfqdn%7D%7D/public_api/v1/incidents/get_incidents/",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "{\"request_data\":{\"filters\":[{\"field\":\"modification_time\",\"operator\":\"in\",\"value\":\"string\"}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"creation_time\",\"keyword\":\"ASC\"}}}",
  CURLOPT_HTTPHEADER => [
    "authorization: {{api_key}}",
    "content-type: application/json",
    "x-xdr-auth-id: {{api_key_id}}"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_URL, "https://api-/%7B%7Bfqdn%7D%7D/public_api/v1/incidents/get_incidents/");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "authorization: {{api_key}}");
headers = curl_slist_append(headers, "x-xdr-auth-id: {{api_key_id}}");
headers = curl_slist_append(headers, "content-type: application/json");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{\"request_data\":{\"filters\":[{\"field\":\"modification_time\",\"operator\":\"in\",\"value\":\"string\"}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"creation_time\",\"keyword\":\"ASC\"}}}");

CURLcode ret = curl_easy_perform(hnd);

var client = new RestClient("https://api-/%7B%7Bfqdn%7D%7D/public_api/v1/incidents/get_incidents/");
var request = new RestRequest(Method.POST);
request.AddHeader("authorization", "{{api_key}}");
request.AddHeader("x-xdr-auth-id", "{{api_key_id}}");
request.AddHeader("content-type", "application/json");
request.AddParameter("application/json", "{\"request_data\":{\"filters\":[{\"field\":\"modification_time\",\"operator\":\"in\",\"value\":\"string\"}],\"search_from\":0,\"search_to\":100,\"sort\":{\"field\":\"creation_time\",\"keyword\":\"ASC\"}}}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

Responses

Successful response

Body

replyObjectrequired

total_countInteger

result_countInteger

incidentsArray

[

incident_idString

is_blockedBoolean

incident_nameString

creation_timeInteger

modification_timeInteger

detection_timeInteger

statusString

severityString

descriptionString

assigned_user_mailString

assigned_user_pretty_nameString

alert_countInteger

low_severity_alert_countInteger

med_severity_alert_countInteger

high_severity_alert_countInteger

critical_severity_alert_countInteger

user_countInteger

host_countInteger

notesString

resolve_commentString

resolved_timestampInteger

manual_severityString

manual_descriptionString

xdr_urlString

starredBoolean

starred_manuallyBoolean

hostsArray[string]

incident_sourcesArray[string]

rule_based_scoreInteger

manual_scoreNumber

aggregated_scoreInteger

alerts_grouping_statusString

alert_categoriesArray[string]

original_tagsArray[string]

tagsArray[string]

xpanse_risk_scoreInteger

xpanse_risk_explainerObject

cvesArray

[

cveIdString

cvssScoreInteger

epssScoreNumber

matchTypeString

exploitMaturityString

reportedExploitInTheWildBoolean

mostRecentReportedExploitDateString

confidenceString

Free-Form object

]

riskFactorsArray

[

attributeIdString

attributeNameString

issueTypesArray

[

displayNameString

issueTypeIdString

Free-Form object

]

Free-Form object

]

versionMatchedBoolean

Free-Form object

cloud_management_statusString

integration_sourceString

ipv4_addressesArray[string]

ipv6_addressesArray[string]

domain_namesArray[string]

port_numberInteger

asset_idsArray[string]

ip_range_idsArray[string]

website_idsArray[string]

service_idsArray[string]

last_observedInteger

cloud_providersArray[string]

country_codesArray[string]

certificate_common_namesArray[string]

certificate_issuersArray[string]

Free-Form object

]

restricted_incident_idsArray[string]

Free-Form object

RESPONSE

{
  "reply": {
    "total_count": 0,
    "result_count": 0,
    "incidents": [
      {
        "incident_id": "incident_id_example",
        "is_blocked": false,
        "incident_name": "incident_name_example",
        "creation_time": 0,
        "modification_time": 0,
        "detection_time": 0,
        "status": "status_example",
        "severity": "severity_example",
        "description": "description_example",
        "assigned_user_mail": "assigned_user_mail_example",
        "assigned_user_pretty_name": "assigned_user_pretty_name_example",
        "alert_count": 0,
        "low_severity_alert_count": 0,
        "med_severity_alert_count": 0,
        "high_severity_alert_count": 0,
        "critical_severity_alert_count": 0,
        "user_count": 0,
        "host_count": 0,
        "notes": "notes_example",
        "resolve_comment": "resolve_comment_example",
        "resolved_timestamp": 0,
        "manual_severity": "manual_severity_example",
        "manual_description": "manual_description_example",
        "xdr_url": "xdr_url_example",
        "starred": false,
        "starred_manually": false,
        "hosts": [
          "hosts_example"
        ],
        "incident_sources": [
          "incident_sources_example"
        ],
        "rule_based_score": 0,
        "manual_score": 0.0,
        "aggregated_score": 0,
        "alerts_grouping_status": "alerts_grouping_status_example",
        "alert_categories": [
          "alert_categories_example"
        ],
        "original_tags": [
          "original_tags_example"
        ],
        "tags": [
          "tags_example"
        ],
        "xpanse_risk_score": 0,
        "xpanse_risk_explainer": {
          "cves": [
            {
              "cveId": "cveId_example",
              "cvssScore": 0,
              "epssScore": 0.0,
              "matchType": "matchType_example",
              "exploitMaturity": "exploitMaturity_example",
              "reportedExploitInTheWild": false,
              "mostRecentReportedExploitDate": "mostRecentReportedExploitDate_example",
              "confidence": "confidence_example"
            }
          ],
          "riskFactors": [
            {
              "attributeId": "attributeId_example",
              "attributeName": "attributeName_example",
              "issueTypes": [
                {
                  "displayName": "displayName_example",
                  "issueTypeId": "issueTypeId_example"
                }
              ]
            }
          ],
          "versionMatched": false
        },
        "cloud_management_status": "cloud_management_status_example",
        "integration_source": "integration_source_example",
        "ipv4_addresses": [
          "ipv4_addresses_example"
        ],
        "ipv6_addresses": [
          "ipv6_addresses_example"
        ],
        "domain_names": [
          "domain_names_example"
        ],
        "port_number": 0,
        "asset_ids": [
          "asset_ids_example"
        ],
        "ip_range_ids": [
          "ip_range_ids_example"
        ],
        "website_ids": [
          "website_ids_example"
        ],
        "service_ids": [
          "service_ids_example"
        ],
        "last_observed": 0,
        "cloud_providers": [
          "cloud_providers_example"
        ],
        "country_codes": [
          "country_codes_example"
        ],
        "certificate_common_names": [
          "certificate_common_names_example"
        ],
        "certificate_issuers": [
          "certificate_issuers_example"
        ]
      }
    ],
    "restricted_incident_ids": [
      "restricted_incident_ids_example"
    ]
  }
}

Bad Request. Got an invalid JSON.

Body

replyObject

The query results upon error.

Free-Form object

RESPONSE

{
  "reply": {}
}

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

Body

replyObject

The query results upon error.

Free-Form object

RESPONSE

{
  "reply": {}
}

Unauthorized access. User does not have the required license type to run this API.

Body

replyObject

The query results upon error.

Free-Form object

RESPONSE

{
  "reply": {}
}

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

Body

replyObject

The query results upon error.

Free-Form object

RESPONSE

{
  "reply": {}
}

Unprocessable Entity

Body

codeInteger

Error code

statusString

Error name

messageString

Error message

errorsObject

Errors

RESPONSE

{
  "code": 0,
  "status": "status_example",
  "message": "message_example",
  "errors": {}
}

Internal server error. A unified status for API communication type errors.

Body

replyObject

The query results upon error.

Free-Form object

RESPONSE

{
  "reply": {}
}