Cortex - Get all Incidents

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cortex - Get all Incidents

L1 Bithead

Hi Cortex API community experts,

 

I am trying to generate a monthly report for various areas of the business for a list of Incidents raised during the month for their respective servers. I was hoping that the "get_incidents" api could help with this. As I could pass in predefinded queries with a list of servers for each department.

 

API:

https://{{url}}/public_api/v1/incidents/get_incidents/

 

Body:

{
           "request_data": {
               "filters": [
                   {
                       "field""description",
                       "operator""contains",
                       "value": ["server1"]
                   }
               ],
               "search_from"0,
               "search_to"100,
               "sort": {
                   "field""creation_time",
                   "keyword""desc"
               }
           }
    }
Response:
{
    "reply": {
        "err_code"400,
        "err_msg""Got an invalid input while processing XDR public API - incident management",
        "err_extra""description must be of type: str"
    }
}
 
Does anyone know why I get this response back "description must be of type:str" ?
 
If I use "in" instead of "contains"it works, though I need to specify the full description string eg: 
"'Memory Corruption Exploit' generated by XDR Agent detected on host server1 involving user johndoe"
This would not fit the purpose though, as I am simply looking to filter all the Incidents for specific hosts for the monthly reports.
 
Many thanks !
 
2 REPLIES 2

L5 Sessionator

Hi @MichaelEdwards2, I would ask this one in the Cortex area: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bd-p/Analytics_Discussions

Help the community: "Like" helpful comments, and click "Accept as Solution" if you found your answer 🙂

L0 Member

Hi Michael,

as the error says, the query filter should contain a "string", you are sending an "array". The API documentation is not always very clear...(https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-manageme...)

Change your query request to:

Body:

{
           "request_data": {
               "filters": [
                   {
                       "field""description",
                       "operator""contains",
                       "value""server1"
                   }
               ],
               "search_from"0,
               "search_to"100,
               "sort": {
                   "field""creation_time",
                   "keyword""desc"
               }
           }
    }

and it should work...

 

Cheers

Phil

Who the f*** is General Failure... and why is he reading my hard disk?
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!