get_incidents filter by status question

[L.Nix028859]

Hi all!

I see the docs (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Incidents) for get_incidents lists only eq/neq operators for the field 'status' and when implementing a new filter model for this endpoint I noticed we are successfully using the 'in' operator:

{'field': 'status', 'operator': 'in', 'value': ['new', 'under_investigation']}
# returns incidents with either 'new' or 'under_investigation' status

 Is this officially supported?

I can't reproduce this affect using two filters like:

'filters': [{'field': 'status', 'operator': 'eq', 'value': 'new'},
{'field': 'status', 'operator': 'eq', 'value': 'under_investigation'}]
# returns empty results - I suspect due to AND concatenation of the filters

 We would like to keep strict implementations per the documentation and thus currently only accept 'eq'/'neq' operators for field: 'status'.

What would be the officially supported method to achieve the same results as 'status' 'in' <list>?

Do I need to use 'status' 'neq' for every status except 'new' and 'under_investigation'?

Thanks!

[aspatil]

Hello @L.Nix028859 ,

We need to check this with product Team. Can you please open CS case for the same? Or please reach out to Accounts Team.

Regards,

Ashutosh

[L.Nix028859]

Hi Ashutosh,

I'd be happy to open a technical CS case. I will reference this discussion.

Thanks!

Lee