Cortex XDR Get Incident API function 'hosts':None

W_Khoo001823 — Tue, 29 Apr 2025 08:10:35 GMT

I'm currently testing the api for Cortex XDR, in particular the 'get_all_incidents' function under '/public_api/v1/incidents/get_incidents' url.

Reference : https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Incidents

While testing, i realized while testing the 'hosts' field is empty, while in the reference page, it mentions <HOST ID>. Is this a bug or it is supposed to be populated if there's more than 2 host in an incident?

Testing Results

Reference Page

Re: Cortex XDR Get Incident API function 'hosts':None

tlmarques — Tue, 29 Apr 2025 16:19:37 GMT

Maybe it's a permissions issue. When you change them, the data you get can change too. I had a similar problem, and it was due to permissions.

topic Cortex XDR Get Incident API function 'hosts':None in Cortex XDR Discussions

Cortex XDR Get Incident API function 'hosts':None

Re: Cortex XDR Get Incident API function 'hosts':None