Cortex XDR Get Incident API function 'hosts':None

[W.Khoo001823]

I'm currently testing the api for Cortex XDR, in particular the 'get_all_incidents' function under '/public_api/v1/incidents/get_incidents' url.

Reference : https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Incidents

While testing, i realized while testing the 'hosts' field is empty, while in the reference page, it mentions <HOST ID>. Is this a bug or it is supposed to be populated if there's more than 2 host in an incident?

Testing Results

Reference Page

[tlmarques]

Maybe it's a permissions issue. When you change them, the data you get can change too. I had a similar problem, and it was due to permissions.