Cortex XSIAM API to get available custom fields in incident

[iawan]

We have an api to update an incident, in it we can also set values for the custom fields we created in the UI.

POST
https://api-<fqdn>/public_api/v1/incidents/update_incident

BODY
{
"request_data": {
"incident_id": "<incident_id>",
"update_data": {
"field_1": " field_1_value",
"field_2": "field_2_value"
}
}
}

Is there an API to get a list of custom fields available for a console, that would return field_1, field_2 ....

[Mudhireddy]

Yes! You can retrieve the list of custom fields available in your Cortex XSIAM or XDR console using the Get Incidents Fields API. This API provides metadata about the available fields, including custom fields.

API Endpoint :POST https://api-<fqdn>/public_api/v1/incidents/get_fields

Request Body

{ "request_data": {}

   }

No parameters are required in the request body.)

Response Example

If successful, the API will return a list of fields, including both default and custom fields. The response will look something like this:

{
"reply": {
"fields": [
{
"name": "field_1",
"description": "Custom Field 1",
"is_custom": true
},
{
"name": "field_2",
"description": "Custom Field 2",
"is_custom": true
},
{
"name": "status",
"description": "Incident Status",
"is_custom": false
}
]
}
}

other points

• Look for fields where "is_custom": true—these are your custom fields.
• The "name" value is what you should use in your update_incident API request.
• The "description" provides the label as seen in the UI.

[iawan]

Unfortunately that endpoint is not working, I have tried it with multiple instances, getting the same error.

Error Code: 500
Internal Server Error

The server encountered an unexpected internal server error

(generated by waitress)