Detail Description of Alert Log Fields XDR API

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Detail Description of Alert Log Fields XDR API

L2 Linker

Hello Everyone, 

 

We are pulling alerts from the XDR API using below endpoint:

/public_api/v1/alerts/get_alerts
 
We query based on creation time which is shown as detection_timestamp in the log. 
I am looking for clarity on below points: 
 
1. what is local_insert_ts field? What is the significance of this field? How it is different from creation time?
2. Without local_insert_ts, is the log available in API to fetch?
3. Is it possible that the local_insert_ts value may get changed for the same event? If it get changed, in what condition it happens?
 
Thank you. 
 
1 accepted solution

Accepted Solutions

L4 Transporter

Hello @sushant1601 

Thanks for reaching out on LiveCommunity!

Please find below answers to your queries.

  1. local_insert_ts field contains the date and time when XDR agent ingests an alert into cortex XDR tenant. In other words, it is the date and time when Cortex XDR’s Investigation and response became aware about an alert.                            Creation_time field represents the date and time when an alert was created on the endpoint.
  2. For the log to be available to fetch , it will be created with insertion time, that is when the log is ingested.
  3. No, each log has its local_insert_ts, once the value is created it wont be changed , when  a new log is ingested into XDR then a new local_insert_ts will be present in the log for that specific event

View solution in original post

3 REPLIES 3

L4 Transporter

Hello @sushant1601 

Thanks for reaching out on LiveCommunity!

Please find below answers to your queries.

  1. local_insert_ts field contains the date and time when XDR agent ingests an alert into cortex XDR tenant. In other words, it is the date and time when Cortex XDR’s Investigation and response became aware about an alert.                            Creation_time field represents the date and time when an alert was created on the endpoint.
  2. For the log to be available to fetch , it will be created with insertion time, that is when the log is ingested.
  3. No, each log has its local_insert_ts, once the value is created it wont be changed , when  a new log is ingested into XDR then a new local_insert_ts will be present in the log for that specific event

L2 Linker

Thank you @nsinghvirk for the quick response. Really appreciate it. 

Followup to your response, currently we query based on creation time to pull logs and to keep a pointer of the log fetched.. If local_insert_ts is the time when XDR agent ingests an alert, can we use this field in the API query to pull the logs? 

 

Thank you again for your response. 

 

L4 Transporter

Hello @sushant1601 

Use of a field depends on the use case or type of data that you want to obtain. Please take help from API reference guide according to your use case.

I hope this answers your question.

  • 1 accepted solution
  • 1653 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!