Detail Description of Alert Log Fields XDR API

[sushant1601]

Hello Everyone, 

We are pulling alerts from the XDR API using below endpoint:

/public_api/v1/alerts/get_alerts

We query based on creation time which is shown as detection_timestamp in the log. 

I am looking for clarity on below points: 

1. what is local_insert_ts field? What is the significance of this field? How it is different from creation time?

2. Without local_insert_ts, is the log available in API to fetch?

3. Is it possible that the local_insert_ts value may get changed for the same event? If it get changed, in what condition it happens?

Thank you. 

Cortex XDR 

[nsinghvirk · Accepted solution]

Hello @sushant1601 

Thanks for reaching out on LiveCommunity!

Please find below answers to your queries.

1. local_insert_ts field contains the date and time when XDR agent ingests an alert into cortex XDR tenant. In other words, it is the date and time when Cortex XDR’s Investigation and response became aware about an alert.                            Creation_time field represents the date and time when an alert was created on the endpoint.
2. For the log to be available to fetch , it will be created with insertion time, that is when the log is ingested.
3. No, each log has its local_insert_ts, once the value is created it wont be changed , when  a new log is ingested into XDR then a new local_insert_ts will be present in the log for that specific event

[sushant1601]

Thank you @nsinghvirk for the quick response. Really appreciate it. 

Followup to your response, currently we query based on creation time to pull logs and to keep a pointer of the log fetched.. If local_insert_ts is the time when XDR agent ingests an alert, can we use this field in the API query to pull the logs? 

Thank you again for your response. 

[nsinghvirk]

Hello @sushant1601 

Use of a field depends on the use case or type of data that you want to obtain. Please take help from API reference guide according to your use case.

I hope this answers your question.