selection criteria for alerts in API call to https://api.ca.prismacloud.io/v2/alert

SIurenko — Tue, 25 Jul 2023 17:06:23 GMT

Hi,

I'm using a call to CSPM Prisma API https://api.ca.prismacloud.io/v2/alert to get changes happened to alerts withing specific time range. For that absolute timeRange filter is used in call parayers with specific stratTime and endTime values set as described in API documentation here https://pan.dev/prisma-cloud/api/cspm/post-alerts-v-2/. In general, the call works and returns a list of alerts with details. But I discovered that all of the alerts I get in the result data set are in status 'open' unless the alert was both opened and closed (dismissed, resolved) within the specified timeRange. In case when the alert was opened before the timeRange and resolved within timeRange it is not included in the result set. Is it expected behavior? Can it be altered to get all alerts that changed the status within timeRange by some call parameters or alert configuration?

Kind regards,

Sergii

Re: selection criteria for alerts in API call to https://api.ca.prismacloud.io/v2/alert

JNeytchev — Mon, 31 Jul 2023 14:43:10 GMT

Hi Sergii,

At a first look, this sounds like the expected behavior, to us a "change" means going from {never opened,open} to {dismissed,snoozed,resolved} within a time interval.

However, let me take a closer look, can you reply with an example of retrieved alerts that demonstrate the problem, together with the query parameters you used?

topic Re: selection criteria for alerts in API call to https://api.ca.prismacloud.io/v2/alert in Prisma Cloud Discussions

selection criteria for alerts in API call to https://api.ca.prismacloud.io/v2/alert

Re: selection criteria for alerts in API call to https://api.ca.prismacloud.io/v2/alert