get_incidents filter by status question

L.Nix028859 — Thu, 03 Apr 2025 16:48:52 GMT

Hi all!

I see the docs (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Incidents) for get_incidents lists only eq/neq operators for the field 'status' and when implementing a new filter model for this endpoint I noticed we are successfully using the 'in' operator:

{'field': 'status', 'operator': 'in', 'value': ['new', 'under_investigation']} # returns incidents with either 'new' or 'under_investigation' status

Is this officially supported?

I can't reproduce this affect using two filters like:

'filters': [{'field': 'status', 'operator': 'eq', 'value': 'new'}, {'field': 'status', 'operator': 'eq', 'value': 'under_investigation'}] # returns empty results - I suspect due to AND concatenation of the filters

We would like to keep strict implementations per the documentation and thus currently only accept 'eq'/'neq' operators for field: 'status'.

What would be the officially supported method to achieve the same results as 'status' 'in' <list>?

Do I need to use 'status' 'neq' for every status except 'new' and 'under_investigation'?

Thanks!

Re: get_incidents filter by status question

aspatil — Wed, 09 Apr 2025 13:26:26 GMT

Hello @L.Nix028859 ,

We need to check this with product Team. Can you please open CS case for the same? Or please reach out to Accounts Team.

Regards,

Ashutosh

Re: get_incidents filter by status question

L.Nix028859 — Wed, 09 Apr 2025 14:13:54 GMT

Hi Ashutosh,

I'd be happy to open a technical CS case. I will reference this discussion.

Thanks!

Lee

topic Re: get_incidents filter by status question in Cortex XDR Discussions

get_incidents filter by status question

Re: get_incidents filter by status question

Re: get_incidents filter by status question