Cortex - Get all Incidents

[MichaelEdwards2]

Hi Cortex API community experts,

I am trying to generate a monthly report for various areas of the business for a list of Incidents raised during the month for their respective servers. I was hoping that the "get_incidents" api could help with this. As I could pass in predefinded queries with a list of servers for each department.

API:

https://{{url}}/public_api/v1/incidents/get_incidents/

Body:

{

           "request_data": {

               "filters": [

                   {

                       "field": "description",

                       "operator": "contains",

                       "value": ["server1"]

                   }

               ],

               "search_from": 0,

               "search_to": 100,

               "sort": {

                   "field": "creation_time",

                   "keyword": "desc"

               }

           }

    }

Response:

{

    "reply": {

        "err_code": 400,

        "err_msg": "Got an invalid input while processing XDR public API - incident management",

        "err_extra": "description must be of type: str"

    }

}

Does anyone know why I get this response back "description must be of type:str" ?

If I use "in" instead of "contains"it works, though I need to specify the full description string eg: 

"'Memory Corruption Exploit' generated by XDR Agent detected on host server1 involving user johndoe"

This would not fit the purpose though, as I am simply looking to filter all the Incidents for specific hosts for the monthly reports.

Many thanks !

[JimmyHolland]

Hi @MichaelEdwards2, I would ask this one in the Cortex area: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bd-p/Analytics_Discussions

[PhilBenson]

Hi Michael,

as the error says, the query filter should contain a "string", you are sending an "array". The API documentation is not always very clear...(https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-manageme...)

Change your query request to:

Body:

{

           "request_data": {

               "filters": [

                   {

                       "field": "description",

                       "operator": "contains",

                       "value": "server1"

                   }

               ],

               "search_from": 0,

               "search_to": 100,

               "sort": {

                   "field": "creation_time",

                   "keyword": "desc"

               }

           }

    }

and it should work...

Cheers

Phil