topic Re: Cortex - Get all Incidents in Automation/API Discussions

Cortex - Get all Incidents

MichaelEdwards2 — Tue, 07 Jun 2022 10:48:27 GMT

Hi Cortex API community experts,

I am trying to generate a monthly report for various areas of the business for a list of Incidents raised during the month for their respective servers. I was hoping that the "get_incidents" api could help with this. As I could pass in predefinded queries with a list of servers for each department.

API:

https://{{url}}/public_api/v1/incidents/get_incidents/

Body:

{

"request_data": {

"filters": [

{

"field": "description",

"operator": "contains",

"value": ["server1"]

}

"search_from": 0,

"search_to": 100,

"sort": {

"field": "creation_time",

"keyword": "desc"

}

Response:

{

"reply": {

"err_code": 400,

"err_msg": "Got an invalid input while processing XDR public API - incident management",

"err_extra": "description must be of type: str"

}

Does anyone know why I get this response back "description must be of type:str" ?

If I use "in" instead of "contains"it works, though I need to specify the full description string eg:

"'Memory Corruption Exploit' generated by XDR Agent detected on host server1 involving user johndoe"

This would not fit the purpose though, as I am simply looking to filter all the Incidents for specific hosts for the monthly reports.

Many thanks !

Re: Cortex - Get all Incidents

JimmyHolland — Mon, 12 Sep 2022 11:31:26 GMT

Hi @MichaelEdwards2, I would ask this one in the Cortex area: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bd-p/Analytics_Discussions

Re: Cortex - Get all Incidents

PhilBenson — Tue, 22 Nov 2022 08:10:22 GMT

Hi Michael,

as the error says, the query filter should contain a "string", you are sending an "array". The API documentation is not always very clear...(https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-management/get-incidents)

Change your query request to: