> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/managed-services/models.md).

# Models

## The ReportStatusDisplay object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"ReportStatusDisplay":{"type":"string","description":"Report status, expressed as its display value. Used in request payloads.","enum":["New","In Progress","On Hold","Resolved False Positive","Resolved True Positive","Resolved Other","Resolved Security Testing"]}}}}
```

## The ReportStatusInternal object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"ReportStatusInternal":{"type":"string","description":"Report status, expressed as its internal name. Always used in responses.","enum":["NEW","IN_PROGRESS","ON_HOLD","RESOLVED_FP","RESOLVED_TP","RESOLVED_OTHER","RESOLVED_SECURITY_TESTING"]}}}}
```

## The Severity object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"Severity":{"type":"string","nullable":true,"description":"Severity level of the report.","enum":["SEV_010_INFO","SEV_020_LOW","SEV_030_MEDIUM","SEV_040_HIGH","SEV_050_CRITICAL","SEV_090_UNKNOWN"]}}}}
```

## The Classification object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"Classification":{"type":"string","description":"Classification of the report. Note the MDR value is the literal string `Unit 42 MDR`, not `MDR`.","enum":["MTH","Unit 42 MDR"]}}}}
```

## The Attachment object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"Attachment":{"type":"object","description":"A single parsed attachment entry. Keys are UPPER_SNAKE_CASE.","properties":{"ATTACHMENT_PATH":{"type":"string","description":"Storage key of the attachment inside the public API GCS bucket"},"ATTACHMENT_SIZE":{"type":"integer","nullable":true,"description":"Size of the attachment in bytes"},"ATTACHMENT_NAME":{"type":"string","nullable":true,"description":"Original file name of the attachment. May be an empty string."}}}}}}
```

## The EmbeddedComment object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"EmbeddedComment":{"type":"object","description":"A comment as embedded inside a `ReportUpperCase.COMMENTS` array. Keys are UPPER_SNAKE_CASE and the field set differs from the standalone `Comment` returned by `get_comments`.","properties":{"COMMENT_ID":{"type":"integer","description":"Unique identifier of the comment"},"COMMENT_CREATED_BY":{"type":"string","description":"Author of the comment. For hunter-authored comments this is masked to the literal `Unit 42 Managed Services` unless the caller is an MTH research user."},"COMMENT_TEXT":{"type":"string","nullable":true,"description":"Text content of the comment"},"COMMENT_INSERT_TIME":{"type":"integer","format":"int64","description":"Creation timestamp in epoch milliseconds"},"COMMENT_UPDATE_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds, or null if never edited"},"COMMENT_USERNAME":{"type":"string","nullable":true,"description":"User name of the account that created the comment"},"COMMENT_ATTACHMENTS":{"type":"array","items":{"$ref":"#/components/schemas/Attachment"},"description":"Parsed attachment metadata. Empty array when the comment has no attachments. Note these are metadata objects, not signed URLs — unlike the `get_comments` endpoint."},"COMMENT_IS_HUNTER":{"type":"boolean","description":"True when the comment was authored by a hunter/analyst rather than the customer"}}},"Attachment":{"type":"object","description":"A single parsed attachment entry. Keys are UPPER_SNAKE_CASE.","properties":{"ATTACHMENT_PATH":{"type":"string","description":"Storage key of the attachment inside the public API GCS bucket"},"ATTACHMENT_SIZE":{"type":"integer","nullable":true,"description":"Size of the attachment in bytes"},"ATTACHMENT_NAME":{"type":"string","nullable":true,"description":"Original file name of the attachment. May be an empty string."}}}}}}
```

## The ReportUpperCase object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"ReportUpperCase":{"type":"object","description":"MTH/MDR report as returned by `get_all_reports`, `get_reports_by_statuses`, `get_reports_by_incident_id`, `report/update/status`, and `report/update/assign`. All keys are UPPER_SNAKE_CASE.","properties":{"XSOAR_SOURCE_ID":{"type":"string","description":"Unique identifier of the report"},"NAME":{"type":"string","nullable":true,"description":"Name/title of the report"},"DESCRIPTION":{"type":"string","nullable":true,"description":"Detailed description of the report"},"CREATED_BY":{"type":"string","nullable":true,"description":"Author of the report. Normalized to `Unit42 Threat Hunting` or `Unit42 MDR` for Palo Alto Networks authored reports."},"INSERT_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Creation timestamp in epoch milliseconds"},"UPDATE_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds"},"ATTACHMENTS":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/Attachment"},"description":"Parsed attachment metadata. Empty array when the report has no attachments. **Always `null`** on the `report/update/status` and `report/update/assign` responses."},"INCIDENT_ID":{"type":"integer","format":"int64","nullable":true,"description":"Associated incident ID. Null for MTH reports, which are not incident-scoped."},"REPORT_TYPE":{"type":"string","nullable":true,"description":"Type of the report, as a display string. Examples: `Threat Report`, `Threat Report Update`, `Impact Report`, `Threat Inquiry`, `Threat Inquiry Update`, `Hunting Report`, `Emerging Threat Report`, `Active Campaigns Report`, `Baseline Hunting Report`, `Threat Profiling Report`, `Cyber Hygiene Report`, `Monthly Status Report`, `Evaluation Summary Report`, `Managed Case Report`."},"SEVERITY":{"$ref":"#/components/schemas/Severity"},"COMMENTS":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EmbeddedComment"},"description":"Comments joined onto the report. Empty array when the report has no comments. **Always `null`** on the `report/update/status` and `report/update/assign` responses."},"CLASSIFICATION":{"$ref":"#/components/schemas/Classification"},"ASSIGNED_USER":{"type":"string","nullable":true,"description":"Email/identifier of the assigned user"},"ASSIGNED_USER_PRETTY":{"type":"string","nullable":true,"description":"Display name of the assigned user"},"REPORT_STATUS":{"$ref":"#/components/schemas/ReportStatusInternal"}}},"Attachment":{"type":"object","description":"A single parsed attachment entry. Keys are UPPER_SNAKE_CASE.","properties":{"ATTACHMENT_PATH":{"type":"string","description":"Storage key of the attachment inside the public API GCS bucket"},"ATTACHMENT_SIZE":{"type":"integer","nullable":true,"description":"Size of the attachment in bytes"},"ATTACHMENT_NAME":{"type":"string","nullable":true,"description":"Original file name of the attachment. May be an empty string."}}},"Severity":{"type":"string","nullable":true,"description":"Severity level of the report.","enum":["SEV_010_INFO","SEV_020_LOW","SEV_030_MEDIUM","SEV_040_HIGH","SEV_050_CRITICAL","SEV_090_UNKNOWN"]},"EmbeddedComment":{"type":"object","description":"A comment as embedded inside a `ReportUpperCase.COMMENTS` array. Keys are UPPER_SNAKE_CASE and the field set differs from the standalone `Comment` returned by `get_comments`.","properties":{"COMMENT_ID":{"type":"integer","description":"Unique identifier of the comment"},"COMMENT_CREATED_BY":{"type":"string","description":"Author of the comment. For hunter-authored comments this is masked to the literal `Unit 42 Managed Services` unless the caller is an MTH research user."},"COMMENT_TEXT":{"type":"string","nullable":true,"description":"Text content of the comment"},"COMMENT_INSERT_TIME":{"type":"integer","format":"int64","description":"Creation timestamp in epoch milliseconds"},"COMMENT_UPDATE_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds, or null if never edited"},"COMMENT_USERNAME":{"type":"string","nullable":true,"description":"User name of the account that created the comment"},"COMMENT_ATTACHMENTS":{"type":"array","items":{"$ref":"#/components/schemas/Attachment"},"description":"Parsed attachment metadata. Empty array when the comment has no attachments. Note these are metadata objects, not signed URLs — unlike the `get_comments` endpoint."},"COMMENT_IS_HUNTER":{"type":"boolean","description":"True when the comment was authored by a hunter/analyst rather than the customer"}}},"Classification":{"type":"string","description":"Classification of the report. Note the MDR value is the literal string `Unit 42 MDR`, not `MDR`.","enum":["MTH","Unit 42 MDR"]},"ReportStatusInternal":{"type":"string","description":"Report status, expressed as its internal name. Always used in responses.","enum":["NEW","IN_PROGRESS","ON_HOLD","RESOLVED_FP","RESOLVED_TP","RESOLVED_OTHER","RESOLVED_SECURITY_TESTING"]}}}}
```

## The ReportRawRow object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"ReportRawRow":{"type":"object","description":"MTH/MDR report as returned **only** by `get_reports_by_source_id`. This is the raw MySQL row: keys are lower_snake_case, `attachments` is a JSON-encoded string, and there is no `comments` field.","properties":{"xsoar_source_id":{"type":"string","description":"Unique identifier of the report"},"report_type":{"type":"string","nullable":true,"description":"Type of the report"},"insert_time":{"type":"integer","format":"int64","nullable":true,"description":"Creation timestamp in epoch milliseconds"},"update_time":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds"},"name":{"type":"string","nullable":true,"description":"Name/title of the report"},"description":{"type":"string","nullable":true,"description":"Detailed description of the report"},"created_by":{"type":"string","nullable":true,"description":"Author of the report"},"incident_id":{"type":"integer","format":"int64","nullable":true,"description":"Associated incident ID"},"severity":{"$ref":"#/components/schemas/Severity"},"attachments":{"type":"string","nullable":true,"description":"Raw MySQL JSON column, returned as a **JSON-encoded string**. `\"{}\"` when there are no attachments. Each key is the storage path and each value is an object with `attachment_name` and `attachment_size` (lower_snake_case)."},"classification":{"$ref":"#/components/schemas/Classification"},"assigned_user":{"type":"string","nullable":true,"description":"Email/identifier of the assigned user"},"assigned_user_pretty":{"type":"string","nullable":true,"description":"Display name of the assigned user"},"report_status":{"$ref":"#/components/schemas/ReportStatusInternal"}}},"Severity":{"type":"string","nullable":true,"description":"Severity level of the report.","enum":["SEV_010_INFO","SEV_020_LOW","SEV_030_MEDIUM","SEV_040_HIGH","SEV_050_CRITICAL","SEV_090_UNKNOWN"]},"Classification":{"type":"string","description":"Classification of the report. Note the MDR value is the literal string `Unit 42 MDR`, not `MDR`.","enum":["MTH","Unit 42 MDR"]},"ReportStatusInternal":{"type":"string","description":"Report status, expressed as its internal name. Always used in responses.","enum":["NEW","IN_PROGRESS","ON_HOLD","RESOLVED_FP","RESOLVED_TP","RESOLVED_OTHER","RESOLVED_SECURITY_TESTING"]}}}}
```

## The Comment object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"Comment":{"type":"object","description":"Standalone comment object returned by `get_comments`. Keys are lower_snake_case.","properties":{"comment_id":{"type":"integer","description":"Unique identifier of the comment"},"comment_created_by":{"type":"string","description":"Free-text author identifier supplied when the comment was created. Not validated and not necessarily an email."},"comment_author_type":{"type":"integer","description":"Numeric author type: `0` = hunter/analyst authored, `1` = customer authored. Returned as an integer, not a string.","enum":[0,1]},"comment_insert_time":{"type":"integer","format":"int64","description":"Creation timestamp in epoch milliseconds"},"comment_update_time":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds, or null if never edited"},"comment_text":{"type":"string","nullable":true,"description":"Text content of the comment"},"comment_attachments":{"type":"array","items":{"type":"string","format":"uri"},"description":"Array of time-limited pre-signed download URLs, one per attachment. Empty array when the comment has no attachments. This is **not** a JSON-encoded object."},"xsoar_source_id":{"type":"string","description":"Source ID of the associated report"},"comment_username":{"type":"string","nullable":true,"description":"User name of the account that created the comment"}}}}}}
```

## The AddCommentRequestData object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"AddCommentRequestData":{"type":"object","required":["xsoar_source_id","comment_text","comment_created_by"],"properties":{"xsoar_source_id":{"type":"string","description":"The unique identifier of the report to comment on"},"comment_text":{"type":"string","maxLength":4096,"description":"The text content of the comment (maximum 4096 characters)."},"comment_created_by":{"type":"string","description":"Email or username of the comment author. Free text; not validated against tenant users."},"path_to_file":{"type":"string","description":"Optional storage key of an attachment already uploaded to the public API GCS bucket. Must start with one of: `send_report/`, `update_report/`, `add_comment/`, `update_comment/`, `comment/`."},"extract_zip_file":{"type":"string","description":"Optional flag indicating the attachment is a zip archive to be extracted. Must be a **string**; only `\"true\"` (case-insensitive) or `\"1\"` enable extraction. A JSON boolean is rejected by type validation.","enum":["true","false","1","0"]}}}}}}
```

## The GetCommentsRequestData object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"GetCommentsRequestData":{"type":"object","description":"Supply either `xsoar_source_id`, or both `start_time` and `end_time`. If `xsoar_source_id` is present the time range is ignored.","properties":{"xsoar_source_id":{"type":"string","description":"The unique identifier of the report"},"start_time":{"type":"integer","format":"int64","description":"Start timestamp in epoch milliseconds. Must be supplied together with `end_time` and must not be greater than it."},"end_time":{"type":"integer","format":"int64","description":"End timestamp in epoch milliseconds. Must be supplied together with `start_time`."}}}}}}
```

## The UpdateReportStatusRequestData object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"UpdateReportStatusRequestData":{"type":"object","required":["xsoar_source_id","report_status"],"properties":{"xsoar_source_id":{"description":"XSOAR source ID of the report to update. Accepts a string or an array of strings; only the first element of an array is used.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"report_status":{"$ref":"#/components/schemas/ReportStatusDisplay"}}},"ReportStatusDisplay":{"type":"string","description":"Report status, expressed as its display value. Used in request payloads.","enum":["New","In Progress","On Hold","Resolved False Positive","Resolved True Positive","Resolved Other","Resolved Security Testing"]}}}}
```

## The UpdateReportAssignUserRequestData object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"UpdateReportAssignUserRequestData":{"type":"object","required":["xsoar_source_id"],"properties":{"xsoar_source_id":{"description":"XSOAR source ID of the report to update. Accepts a string or an array of strings; only the first element of an array is used.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]},"user":{"type":"string","nullable":true,"description":"Identifier (typically email) of the user to assign the report to. Validated against the tenant's users. Omit or set to `null` to clear the assignment."},"username":{"type":"string","nullable":true,"description":"Display name of the assignee. Free text; not validated. Forced to `null` when `user` is `null`."}}}}}}
```

## The GetReportsBySourceIdRequestData object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"GetReportsBySourceIdRequestData":{"type":"object","required":["xsoar_source_ids"],"properties":{"xsoar_source_ids":{"description":"A single XSOAR source ID or an array of XSOAR source IDs. Values must be non-empty strings.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"},"minItems":1}]}}}}}}
```

## The GetReportsByIncidentIdRequestData object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"GetReportsByIncidentIdRequestData":{"type":"object","required":["incident_ids"],"properties":{"incident_ids":{"description":"A single incident ID or an array of incident IDs. Values must be non-empty **strings**; numeric JSON values are rejected.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"},"minItems":1}]}}}}}}
```

## The GetReportsByStatusesRequestData object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"GetReportsByStatusesRequestData":{"type":"object","required":["report_statuses"],"properties":{"report_statuses":{"type":"array","minItems":1,"items":{"$ref":"#/components/schemas/ReportStatusDisplay"},"description":"Non-empty array of report statuses to filter by. Must be an array; a bare string is rejected."}}},"ReportStatusDisplay":{"type":"string","description":"Report status, expressed as its display value. Used in request payloads.","enum":["New","In Progress","On Hold","Resolved False Positive","Resolved True Positive","Resolved Other","Resolved Security Testing"]}}}}
```

## The AddCommentResponse object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"AddCommentResponse":{"type":"object","properties":{"reply":{"type":"boolean","description":"`true` when the comment was added successfully. Failures are returned as an error response, not as `false`."}}}}}}
```

## The GetCommentsResponse object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"GetCommentsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"status":{"type":"boolean","description":"Operation success status"},"data":{"type":"array","items":{"$ref":"#/components/schemas/Comment"},"description":"Array of comment objects matching the query"}}}}},"Comment":{"type":"object","description":"Standalone comment object returned by `get_comments`. Keys are lower_snake_case.","properties":{"comment_id":{"type":"integer","description":"Unique identifier of the comment"},"comment_created_by":{"type":"string","description":"Free-text author identifier supplied when the comment was created. Not validated and not necessarily an email."},"comment_author_type":{"type":"integer","description":"Numeric author type: `0` = hunter/analyst authored, `1` = customer authored. Returned as an integer, not a string.","enum":[0,1]},"comment_insert_time":{"type":"integer","format":"int64","description":"Creation timestamp in epoch milliseconds"},"comment_update_time":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds, or null if never edited"},"comment_text":{"type":"string","nullable":true,"description":"Text content of the comment"},"comment_attachments":{"type":"array","items":{"type":"string","format":"uri"},"description":"Array of time-limited pre-signed download URLs, one per attachment. Empty array when the comment has no attachments. This is **not** a JSON-encoded object."},"xsoar_source_id":{"type":"string","description":"Source ID of the associated report"},"comment_username":{"type":"string","nullable":true,"description":"User name of the account that created the comment"}}}}}}
```

## The SingleReportResponse object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"SingleReportResponse":{"type":"object","description":"Response for the status-update and assignment-update endpoints. `reply.COMMENTS` and `reply.ATTACHMENTS` are always `null` here.","properties":{"reply":{"$ref":"#/components/schemas/ReportUpperCase"}}},"ReportUpperCase":{"type":"object","description":"MTH/MDR report as returned by `get_all_reports`, `get_reports_by_statuses`, `get_reports_by_incident_id`, `report/update/status`, and `report/update/assign`. All keys are UPPER_SNAKE_CASE.","properties":{"XSOAR_SOURCE_ID":{"type":"string","description":"Unique identifier of the report"},"NAME":{"type":"string","nullable":true,"description":"Name/title of the report"},"DESCRIPTION":{"type":"string","nullable":true,"description":"Detailed description of the report"},"CREATED_BY":{"type":"string","nullable":true,"description":"Author of the report. Normalized to `Unit42 Threat Hunting` or `Unit42 MDR` for Palo Alto Networks authored reports."},"INSERT_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Creation timestamp in epoch milliseconds"},"UPDATE_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds"},"ATTACHMENTS":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/Attachment"},"description":"Parsed attachment metadata. Empty array when the report has no attachments. **Always `null`** on the `report/update/status` and `report/update/assign` responses."},"INCIDENT_ID":{"type":"integer","format":"int64","nullable":true,"description":"Associated incident ID. Null for MTH reports, which are not incident-scoped."},"REPORT_TYPE":{"type":"string","nullable":true,"description":"Type of the report, as a display string. Examples: `Threat Report`, `Threat Report Update`, `Impact Report`, `Threat Inquiry`, `Threat Inquiry Update`, `Hunting Report`, `Emerging Threat Report`, `Active Campaigns Report`, `Baseline Hunting Report`, `Threat Profiling Report`, `Cyber Hygiene Report`, `Monthly Status Report`, `Evaluation Summary Report`, `Managed Case Report`."},"SEVERITY":{"$ref":"#/components/schemas/Severity"},"COMMENTS":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EmbeddedComment"},"description":"Comments joined onto the report. Empty array when the report has no comments. **Always `null`** on the `report/update/status` and `report/update/assign` responses."},"CLASSIFICATION":{"$ref":"#/components/schemas/Classification"},"ASSIGNED_USER":{"type":"string","nullable":true,"description":"Email/identifier of the assigned user"},"ASSIGNED_USER_PRETTY":{"type":"string","nullable":true,"description":"Display name of the assigned user"},"REPORT_STATUS":{"$ref":"#/components/schemas/ReportStatusInternal"}}},"Attachment":{"type":"object","description":"A single parsed attachment entry. Keys are UPPER_SNAKE_CASE.","properties":{"ATTACHMENT_PATH":{"type":"string","description":"Storage key of the attachment inside the public API GCS bucket"},"ATTACHMENT_SIZE":{"type":"integer","nullable":true,"description":"Size of the attachment in bytes"},"ATTACHMENT_NAME":{"type":"string","nullable":true,"description":"Original file name of the attachment. May be an empty string."}}},"Severity":{"type":"string","nullable":true,"description":"Severity level of the report.","enum":["SEV_010_INFO","SEV_020_LOW","SEV_030_MEDIUM","SEV_040_HIGH","SEV_050_CRITICAL","SEV_090_UNKNOWN"]},"EmbeddedComment":{"type":"object","description":"A comment as embedded inside a `ReportUpperCase.COMMENTS` array. Keys are UPPER_SNAKE_CASE and the field set differs from the standalone `Comment` returned by `get_comments`.","properties":{"COMMENT_ID":{"type":"integer","description":"Unique identifier of the comment"},"COMMENT_CREATED_BY":{"type":"string","description":"Author of the comment. For hunter-authored comments this is masked to the literal `Unit 42 Managed Services` unless the caller is an MTH research user."},"COMMENT_TEXT":{"type":"string","nullable":true,"description":"Text content of the comment"},"COMMENT_INSERT_TIME":{"type":"integer","format":"int64","description":"Creation timestamp in epoch milliseconds"},"COMMENT_UPDATE_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds, or null if never edited"},"COMMENT_USERNAME":{"type":"string","nullable":true,"description":"User name of the account that created the comment"},"COMMENT_ATTACHMENTS":{"type":"array","items":{"$ref":"#/components/schemas/Attachment"},"description":"Parsed attachment metadata. Empty array when the comment has no attachments. Note these are metadata objects, not signed URLs — unlike the `get_comments` endpoint."},"COMMENT_IS_HUNTER":{"type":"boolean","description":"True when the comment was authored by a hunter/analyst rather than the customer"}}},"Classification":{"type":"string","description":"Classification of the report. Note the MDR value is the literal string `Unit 42 MDR`, not `MDR`.","enum":["MTH","Unit 42 MDR"]},"ReportStatusInternal":{"type":"string","description":"Report status, expressed as its internal name. Always used in responses.","enum":["NEW","IN_PROGRESS","ON_HOLD","RESOLVED_FP","RESOLVED_TP","RESOLVED_OTHER","RESOLVED_SECURITY_TESTING"]}}}}
```

## The GetReportsBySourceIdResponse object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"GetReportsBySourceIdResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"status":{"type":"boolean","description":"Operation success status"},"data":{"type":"array","items":{"$ref":"#/components/schemas/ReportRawRow"},"description":"Array of raw report rows matching the requested source IDs. Note the lower_snake_case field names and the string-encoded `attachments`."}}}}},"ReportRawRow":{"type":"object","description":"MTH/MDR report as returned **only** by `get_reports_by_source_id`. This is the raw MySQL row: keys are lower_snake_case, `attachments` is a JSON-encoded string, and there is no `comments` field.","properties":{"xsoar_source_id":{"type":"string","description":"Unique identifier of the report"},"report_type":{"type":"string","nullable":true,"description":"Type of the report"},"insert_time":{"type":"integer","format":"int64","nullable":true,"description":"Creation timestamp in epoch milliseconds"},"update_time":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds"},"name":{"type":"string","nullable":true,"description":"Name/title of the report"},"description":{"type":"string","nullable":true,"description":"Detailed description of the report"},"created_by":{"type":"string","nullable":true,"description":"Author of the report"},"incident_id":{"type":"integer","format":"int64","nullable":true,"description":"Associated incident ID"},"severity":{"$ref":"#/components/schemas/Severity"},"attachments":{"type":"string","nullable":true,"description":"Raw MySQL JSON column, returned as a **JSON-encoded string**. `\"{}\"` when there are no attachments. Each key is the storage path and each value is an object with `attachment_name` and `attachment_size` (lower_snake_case)."},"classification":{"$ref":"#/components/schemas/Classification"},"assigned_user":{"type":"string","nullable":true,"description":"Email/identifier of the assigned user"},"assigned_user_pretty":{"type":"string","nullable":true,"description":"Display name of the assigned user"},"report_status":{"$ref":"#/components/schemas/ReportStatusInternal"}}},"Severity":{"type":"string","nullable":true,"description":"Severity level of the report.","enum":["SEV_010_INFO","SEV_020_LOW","SEV_030_MEDIUM","SEV_040_HIGH","SEV_050_CRITICAL","SEV_090_UNKNOWN"]},"Classification":{"type":"string","description":"Classification of the report. Note the MDR value is the literal string `Unit 42 MDR`, not `MDR`.","enum":["MTH","Unit 42 MDR"]},"ReportStatusInternal":{"type":"string","description":"Report status, expressed as its internal name. Always used in responses.","enum":["NEW","IN_PROGRESS","ON_HOLD","RESOLVED_FP","RESOLVED_TP","RESOLVED_OTHER","RESOLVED_SECURITY_TESTING"]}}}}
```

## The GetReportsByIncidentIdResponse object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"GetReportsByIncidentIdResponse":{"type":"object","properties":{"reply":{"type":"array","items":{"$ref":"#/components/schemas/ReportUpperCase"},"description":"Bare array of report objects matching the requested incident IDs. There is no `DATA`/`COUNT` wrapper on this endpoint."}}},"ReportUpperCase":{"type":"object","description":"MTH/MDR report as returned by `get_all_reports`, `get_reports_by_statuses`, `get_reports_by_incident_id`, `report/update/status`, and `report/update/assign`. All keys are UPPER_SNAKE_CASE.","properties":{"XSOAR_SOURCE_ID":{"type":"string","description":"Unique identifier of the report"},"NAME":{"type":"string","nullable":true,"description":"Name/title of the report"},"DESCRIPTION":{"type":"string","nullable":true,"description":"Detailed description of the report"},"CREATED_BY":{"type":"string","nullable":true,"description":"Author of the report. Normalized to `Unit42 Threat Hunting` or `Unit42 MDR` for Palo Alto Networks authored reports."},"INSERT_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Creation timestamp in epoch milliseconds"},"UPDATE_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds"},"ATTACHMENTS":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/Attachment"},"description":"Parsed attachment metadata. Empty array when the report has no attachments. **Always `null`** on the `report/update/status` and `report/update/assign` responses."},"INCIDENT_ID":{"type":"integer","format":"int64","nullable":true,"description":"Associated incident ID. Null for MTH reports, which are not incident-scoped."},"REPORT_TYPE":{"type":"string","nullable":true,"description":"Type of the report, as a display string. Examples: `Threat Report`, `Threat Report Update`, `Impact Report`, `Threat Inquiry`, `Threat Inquiry Update`, `Hunting Report`, `Emerging Threat Report`, `Active Campaigns Report`, `Baseline Hunting Report`, `Threat Profiling Report`, `Cyber Hygiene Report`, `Monthly Status Report`, `Evaluation Summary Report`, `Managed Case Report`."},"SEVERITY":{"$ref":"#/components/schemas/Severity"},"COMMENTS":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EmbeddedComment"},"description":"Comments joined onto the report. Empty array when the report has no comments. **Always `null`** on the `report/update/status` and `report/update/assign` responses."},"CLASSIFICATION":{"$ref":"#/components/schemas/Classification"},"ASSIGNED_USER":{"type":"string","nullable":true,"description":"Email/identifier of the assigned user"},"ASSIGNED_USER_PRETTY":{"type":"string","nullable":true,"description":"Display name of the assigned user"},"REPORT_STATUS":{"$ref":"#/components/schemas/ReportStatusInternal"}}},"Attachment":{"type":"object","description":"A single parsed attachment entry. Keys are UPPER_SNAKE_CASE.","properties":{"ATTACHMENT_PATH":{"type":"string","description":"Storage key of the attachment inside the public API GCS bucket"},"ATTACHMENT_SIZE":{"type":"integer","nullable":true,"description":"Size of the attachment in bytes"},"ATTACHMENT_NAME":{"type":"string","nullable":true,"description":"Original file name of the attachment. May be an empty string."}}},"Severity":{"type":"string","nullable":true,"description":"Severity level of the report.","enum":["SEV_010_INFO","SEV_020_LOW","SEV_030_MEDIUM","SEV_040_HIGH","SEV_050_CRITICAL","SEV_090_UNKNOWN"]},"EmbeddedComment":{"type":"object","description":"A comment as embedded inside a `ReportUpperCase.COMMENTS` array. Keys are UPPER_SNAKE_CASE and the field set differs from the standalone `Comment` returned by `get_comments`.","properties":{"COMMENT_ID":{"type":"integer","description":"Unique identifier of the comment"},"COMMENT_CREATED_BY":{"type":"string","description":"Author of the comment. For hunter-authored comments this is masked to the literal `Unit 42 Managed Services` unless the caller is an MTH research user."},"COMMENT_TEXT":{"type":"string","nullable":true,"description":"Text content of the comment"},"COMMENT_INSERT_TIME":{"type":"integer","format":"int64","description":"Creation timestamp in epoch milliseconds"},"COMMENT_UPDATE_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds, or null if never edited"},"COMMENT_USERNAME":{"type":"string","nullable":true,"description":"User name of the account that created the comment"},"COMMENT_ATTACHMENTS":{"type":"array","items":{"$ref":"#/components/schemas/Attachment"},"description":"Parsed attachment metadata. Empty array when the comment has no attachments. Note these are metadata objects, not signed URLs — unlike the `get_comments` endpoint."},"COMMENT_IS_HUNTER":{"type":"boolean","description":"True when the comment was authored by a hunter/analyst rather than the customer"}}},"Classification":{"type":"string","description":"Classification of the report. Note the MDR value is the literal string `Unit 42 MDR`, not `MDR`.","enum":["MTH","Unit 42 MDR"]},"ReportStatusInternal":{"type":"string","description":"Report status, expressed as its internal name. Always used in responses.","enum":["NEW","IN_PROGRESS","ON_HOLD","RESOLVED_FP","RESOLVED_TP","RESOLVED_OTHER","RESOLVED_SECURITY_TESTING"]}}}}
```

## The GetAllReportsResponse object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"GetAllReportsResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"DATA":{"type":"array","items":{"$ref":"#/components/schemas/ReportUpperCase"},"description":"Array of report objects matching the query"},"COUNT":{"type":"integer","description":"Number of reports matching the applied filters"}}}}},"ReportUpperCase":{"type":"object","description":"MTH/MDR report as returned by `get_all_reports`, `get_reports_by_statuses`, `get_reports_by_incident_id`, `report/update/status`, and `report/update/assign`. All keys are UPPER_SNAKE_CASE.","properties":{"XSOAR_SOURCE_ID":{"type":"string","description":"Unique identifier of the report"},"NAME":{"type":"string","nullable":true,"description":"Name/title of the report"},"DESCRIPTION":{"type":"string","nullable":true,"description":"Detailed description of the report"},"CREATED_BY":{"type":"string","nullable":true,"description":"Author of the report. Normalized to `Unit42 Threat Hunting` or `Unit42 MDR` for Palo Alto Networks authored reports."},"INSERT_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Creation timestamp in epoch milliseconds"},"UPDATE_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds"},"ATTACHMENTS":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/Attachment"},"description":"Parsed attachment metadata. Empty array when the report has no attachments. **Always `null`** on the `report/update/status` and `report/update/assign` responses."},"INCIDENT_ID":{"type":"integer","format":"int64","nullable":true,"description":"Associated incident ID. Null for MTH reports, which are not incident-scoped."},"REPORT_TYPE":{"type":"string","nullable":true,"description":"Type of the report, as a display string. Examples: `Threat Report`, `Threat Report Update`, `Impact Report`, `Threat Inquiry`, `Threat Inquiry Update`, `Hunting Report`, `Emerging Threat Report`, `Active Campaigns Report`, `Baseline Hunting Report`, `Threat Profiling Report`, `Cyber Hygiene Report`, `Monthly Status Report`, `Evaluation Summary Report`, `Managed Case Report`."},"SEVERITY":{"$ref":"#/components/schemas/Severity"},"COMMENTS":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EmbeddedComment"},"description":"Comments joined onto the report. Empty array when the report has no comments. **Always `null`** on the `report/update/status` and `report/update/assign` responses."},"CLASSIFICATION":{"$ref":"#/components/schemas/Classification"},"ASSIGNED_USER":{"type":"string","nullable":true,"description":"Email/identifier of the assigned user"},"ASSIGNED_USER_PRETTY":{"type":"string","nullable":true,"description":"Display name of the assigned user"},"REPORT_STATUS":{"$ref":"#/components/schemas/ReportStatusInternal"}}},"Attachment":{"type":"object","description":"A single parsed attachment entry. Keys are UPPER_SNAKE_CASE.","properties":{"ATTACHMENT_PATH":{"type":"string","description":"Storage key of the attachment inside the public API GCS bucket"},"ATTACHMENT_SIZE":{"type":"integer","nullable":true,"description":"Size of the attachment in bytes"},"ATTACHMENT_NAME":{"type":"string","nullable":true,"description":"Original file name of the attachment. May be an empty string."}}},"Severity":{"type":"string","nullable":true,"description":"Severity level of the report.","enum":["SEV_010_INFO","SEV_020_LOW","SEV_030_MEDIUM","SEV_040_HIGH","SEV_050_CRITICAL","SEV_090_UNKNOWN"]},"EmbeddedComment":{"type":"object","description":"A comment as embedded inside a `ReportUpperCase.COMMENTS` array. Keys are UPPER_SNAKE_CASE and the field set differs from the standalone `Comment` returned by `get_comments`.","properties":{"COMMENT_ID":{"type":"integer","description":"Unique identifier of the comment"},"COMMENT_CREATED_BY":{"type":"string","description":"Author of the comment. For hunter-authored comments this is masked to the literal `Unit 42 Managed Services` unless the caller is an MTH research user."},"COMMENT_TEXT":{"type":"string","nullable":true,"description":"Text content of the comment"},"COMMENT_INSERT_TIME":{"type":"integer","format":"int64","description":"Creation timestamp in epoch milliseconds"},"COMMENT_UPDATE_TIME":{"type":"integer","format":"int64","nullable":true,"description":"Last update timestamp in epoch milliseconds, or null if never edited"},"COMMENT_USERNAME":{"type":"string","nullable":true,"description":"User name of the account that created the comment"},"COMMENT_ATTACHMENTS":{"type":"array","items":{"$ref":"#/components/schemas/Attachment"},"description":"Parsed attachment metadata. Empty array when the comment has no attachments. Note these are metadata objects, not signed URLs — unlike the `get_comments` endpoint."},"COMMENT_IS_HUNTER":{"type":"boolean","description":"True when the comment was authored by a hunter/analyst rather than the customer"}}},"Classification":{"type":"string","description":"Classification of the report. Note the MDR value is the literal string `Unit 42 MDR`, not `MDR`.","enum":["MTH","Unit 42 MDR"]},"ReportStatusInternal":{"type":"string","description":"Report status, expressed as its internal name. Always used in responses.","enum":["NEW","IN_PROGRESS","ON_HOLD","RESOLVED_FP","RESOLVED_TP","RESOLVED_OTHER","RESOLVED_SECURITY_TESTING"]}}}}
```

## The BaseError object

```json
{"openapi":"3.0.1","info":{"title":"Managed Services APIs","version":"1.0.1"},"components":{"schemas":{"BaseError":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"Numeric error code, mirroring the HTTP status code. Most validation and business-logic failures on these endpoints return 500."},"err_msg":{"type":"string","description":"Generic error message, for example `An error occurred while processing XDR public API`."},"err_extra":{"type":"string","nullable":true,"description":"Specific reason for the failure. This is the field to inspect when diagnosing a rejected request."}}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/managed-services/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.