Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Reports

APIs for retrieving MTH/MDR reports

Get reports by source ID

post

Retrieves one or more MTH/MDR reports by their xsoar_source_id values.

Validation rules:

  • xsoar_source_ids is required and must be a non-empty string or a non-empty array of non-empty strings.

Response notes — this endpoint differs from all the others:

  • Rows are returned exactly as stored in MySQL, so field names are lower_snake_case (xsoar_source_id, incident_id, ...), unlike every other reports endpoint which returns UPPER_SNAKE_CASE.

  • attachments is the raw JSON column returned as a JSON-encoded string (for example "{}" or "{\"update_report/...\": {...}}"), not a parsed array.

  • There is no comments field on this response; comments are not joined here.

  • created_by is included (it is absent from no shape, but note it is present here as a raw column).

  • The response is wrapped in reply.status / reply.data.

Required licenses: MDR, MTH, Managed XSIAM Pro, Managed XSIAM Premium.

Permissions: Users with Instance Administrator privileges only can access these endpoints.

Authorizations
AuthorizationstringRequired

API Key for authentication

x-xdr-auth-idstringRequired

API Key ID for authentication

Header parameters
AuthorizationstringRequired

{api_key}

Example: YOUR_API_KEY_HERE
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
xsoar_source_idsone ofRequired

A single XSOAR source ID or an array of XSOAR source IDs. Values must be non-empty strings.

stringOptional
or
string[] · min: 1Optional
Responses
200

Successful Response

application/json
post/public_api/v1/mth/child/get_reports_by_source_id
POST /public_api/v1/mth/child/get_reports_by_source_id HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY_HERE
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 29

{
  "xsoar_source_ids": "777771"
}
{
  "reply": {
    "status": true,
    "data": [
      {
        "xsoar_source_id": "777771",
        "report_type": "Threat Report Update",
        "insert_time": 1763468832000,
        "update_time": 1765983782000,
        "name": "Updated Report 5",
        "description": "Updated description",
        "created_by": "Unit42 Threat Hunting",
        "incident_id": 1,
        "severity": "SEV_040_HIGH",
        "attachments": "{\"update_report/1764864986901--f2ada4b9-d7f2-43cb-978c-91cc2eb4c97d\": {\"attachment_name\": \"\", \"attachment_size\": 0}}",
        "classification": "MTH",
        "assigned_user": "iavron@example.com",
        "assigned_user_pretty": "iavron iavron",
        "report_status": "ON_HOLD"
      }
    ]
  }
}

Get reports by incident ID

post

Retrieves MTH/MDR reports associated with one or more incident IDs.

Validation rules:

  • incident_ids is required and must be a non-empty string or a non-empty array of non-empty strings. Numeric JSON values are rejected by input validation even though the underlying column is an integer — send IDs as strings.

Response notes:

  • reply is a bare array of reports. Unlike get_all_reports and get_reports_by_statuses, there is no DATA/COUNT wrapper, and unlike get_reports_by_source_id there is no status/data wrapper.

  • Reports use the UPPER_SNAKE_CASE shape (ReportUpperCase) and include the COMMENTS array and the parsed ATTACHMENTS array.

  • MTH reports typically have no incident association, so this endpoint mostly returns MDR reports.

Required licenses: MDR, MTH, Managed XSIAM Pro, Managed XSIAM Premium.

Permissions: Users with Instance Administrator privileges only can access these endpoints.

Authorizations
AuthorizationstringRequired

API Key for authentication

x-xdr-auth-idstringRequired

API Key ID for authentication

Header parameters
AuthorizationstringRequired

{api_key}

Example: YOUR_API_KEY_HERE
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
incident_idsone ofRequired

A single incident ID or an array of incident IDs. Values must be non-empty strings; numeric JSON values are rejected.

stringOptional
or
string[] · min: 1Optional
Responses
200

Successful Response

application/json
post/public_api/v1/mth/child/get_reports_by_incident_id
POST /public_api/v1/mth/child/get_reports_by_incident_id HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY_HERE
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 20

{
  "incident_ids": "1"
}
{
  "reply": [
    {
      "XSOAR_SOURCE_ID": "777771",
      "NAME": "Updated Report 5",
      "DESCRIPTION": "Updated description",
      "CREATED_BY": "Unit42 MDR",
      "INSERT_TIME": 1763468832000,
      "UPDATE_TIME": 1765983782000,
      "ATTACHMENTS": [],
      "INCIDENT_ID": 1,
      "REPORT_TYPE": "Threat Report Update",
      "SEVERITY": "SEV_040_HIGH",
      "COMMENTS": [],
      "CLASSIFICATION": "Unit 42 MDR",
      "ASSIGNED_USER": "iavron@example.com",
      "ASSIGNED_USER_PRETTY": "iavron iavron",
      "REPORT_STATUS": "ON_HOLD"
    }
  ]
}

Get all MTH/MDR reports

post

Retrieves all MTH/MDR reports for the calling child tenant.

This endpoint takes no request parameters; any supplied body is ignored. Send {}.

Response notes:

  • Reports use the UPPER_SNAKE_CASE shape (ReportUpperCase) and include the joined COMMENTS array and the parsed ATTACHMENTS array.

  • COUNT is derived from the internal FILTER_COUNT (number of reports matching the query). The internal TOTAL_COUNT field is stripped from the response.

  • No paging is applied, so the full report set for the tenant is returned in one response.

Required licenses: MDR, MTH, Managed XSIAM Pro, Managed XSIAM Premium.

Permissions: Users with Instance Administrator privileges only can access these endpoints.

Authorizations
AuthorizationstringRequired

API Key for authentication

x-xdr-auth-idstringRequired

API Key ID for authentication

Header parameters
AuthorizationstringRequired

{api_key}

Example: YOUR_API_KEY_HERE
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
objectOptional

Empty request body. No parameters are required.

Responses
200

Successful Response

application/json
post/public_api/v1/mth/child/get_all_reports
POST /public_api/v1/mth/child/get_all_reports HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY_HERE
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
{
  "reply": {
    "DATA": [
      {
        "XSOAR_SOURCE_ID": "777771",
        "NAME": "Updated Report 5",
        "DESCRIPTION": "Updated description",
        "CREATED_BY": "Unit42 Threat Hunting",
        "INSERT_TIME": 1763468832000,
        "UPDATE_TIME": 1765983782000,
        "ATTACHMENTS": [
          {
            "ATTACHMENT_PATH": "update_report/1764864986901--f2ada4b9-d7f2-43cb-978c-91cc2eb4c97d",
            "ATTACHMENT_SIZE": 0,
            "ATTACHMENT_NAME": ""
          }
        ],
        "INCIDENT_ID": 1,
        "REPORT_TYPE": "Threat Report Update",
        "SEVERITY": "SEV_040_HIGH",
        "COMMENTS": [
          {
            "COMMENT_ID": 21,
            "COMMENT_CREATED_BY": "Unit 42 Managed Services",
            "COMMENT_TEXT": "Hunter follow-up",
            "COMMENT_INSERT_TIME": 1763468843000,
            "COMMENT_UPDATE_TIME": null,
            "COMMENT_USERNAME": "analyst@company.com",
            "COMMENT_ATTACHMENTS": [],
            "COMMENT_IS_HUNTER": true
          }
        ],
        "CLASSIFICATION": "MTH",
        "ASSIGNED_USER": "iavron@example.com",
        "ASSIGNED_USER_PRETTY": "iavron iavron",
        "REPORT_STATUS": "ON_HOLD"
      },
      {
        "XSOAR_SOURCE_ID": "777772",
        "NAME": "Royi test",
        "DESCRIPTION": "Royi",
        "CREATED_BY": "Unit42 Threat Hunting",
        "INSERT_TIME": 1763468615000,
        "UPDATE_TIME": 1763468623000,
        "ATTACHMENTS": [
          {
            "ATTACHMENT_PATH": "update_report/1763468621971-sample.pdf-9b2feb72-0835-4ccf-b49c-e192550bf85f",
            "ATTACHMENT_SIZE": 55483,
            "ATTACHMENT_NAME": "sample.pdf"
          }
        ],
        "INCIDENT_ID": null,
        "REPORT_TYPE": "Monthly Status Report",
        "SEVERITY": "SEV_020_LOW",
        "COMMENTS": [],
        "CLASSIFICATION": "MTH",
        "ASSIGNED_USER": null,
        "ASSIGNED_USER_PRETTY": null,
        "REPORT_STATUS": "NEW"
      }
    ],
    "COUNT": 2
  }
}

Get reports by statuses

post

Retrieves MTH/MDR reports filtered by one or more status values.

Validation rules:

  • report_statuses is required and must be a non-empty array of strings. A bare string is rejected.

  • Each entry must be one of the supported display values: New, In Progress, On Hold, Resolved False Positive, Resolved True Positive, Resolved Other, Resolved Security Testing. There is no single Resolved value — the four resolved outcomes are distinct.

  • Invalid values fail the request with a message listing the supported statuses.

Response notes:

  • Identical shape to get_all_reports: reply.DATA (array of ReportUpperCase) plus reply.COUNT.

  • REPORT_STATUS in the response is the internal name (for example RESOLVED_FP), not the display value used in the request.

Required licenses: MDR, MTH, Managed XSIAM Pro, Managed XSIAM Premium.

Permissions: Users with Instance Administrator privileges only can access these endpoints.

Authorizations
AuthorizationstringRequired

API Key for authentication

x-xdr-auth-idstringRequired

API Key ID for authentication

Header parameters
AuthorizationstringRequired

{api_key}

Example: YOUR_API_KEY_HERE
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

Successful Response

application/json
post/public_api/v1/mth/child/get_reports_by_statuses
POST /public_api/v1/mth/child/get_reports_by_statuses HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY_HERE
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 27

{
  "report_statuses": [
    "New"
  ]
}
{
  "reply": {
    "DATA": [
      {
        "XSOAR_SOURCE_ID": "777771",
        "NAME": "Updated Report 5",
        "DESCRIPTION": "Updated description",
        "CREATED_BY": "Unit42 Threat Hunting",
        "INSERT_TIME": 1763468832000,
        "UPDATE_TIME": 1765983782000,
        "ATTACHMENTS": [],
        "INCIDENT_ID": 1,
        "REPORT_TYPE": "Threat Report Update",
        "SEVERITY": "SEV_040_HIGH",
        "COMMENTS": [],
        "CLASSIFICATION": "MTH",
        "ASSIGNED_USER": "iavron@example.com",
        "ASSIGNED_USER_PRETTY": "iavron iavron",
        "REPORT_STATUS": "IN_PROGRESS"
      }
    ],
    "COUNT": 1
  }
}
PreviousComments
NextStatus

Last updated

Was this helpful?