Issues Commands
listIssues
Returns a list of issues and their metadata, filtered by built-in arguments or by a JSON filter object supplied via filter_object/custom_filter. Multiple filter arguments are concatenated using the AND operator, while arguments that support a comma-separated list of values use an OR operator between each value. Returned list issues if no arguments are provided.
Arguments
issue_ids
A comma-separated list of unique issue IDs.
Optional
severity
A comma-separated list of issue severities. Possible values are: low, medium, high, critical.
Optional
filter_object
A JSON string representing a raw filter object. If provided, this overrides all other filter arguments.
Optional
custom_filter
A custom filter. When this argument is used, the other filter arguments are not relevant.
Optional
Identity_types
A comma-separated list of account types. Possible values are: ANONYMOUS, APPLICATION, COMPUTE, FEDERATED_IDENTITY, SERVICE, SERVICE_ACCOUNT, TEMPORARY_CREDENTIALS, TOKEN, UNKNOWN, USER.
Optional
agent_ids
A comma-separated list of unique agent identifiers.
Optional
action_external_hostnames
A comma-separated list of hostnames to connect to.
Optional
rule_ids
A comma-separated list of user rule identifiers.
Optional
rule_names
A comma-separated list of user rule names.
Optional
issue_names
A comma-separated list of issue names.
Optional
issue_sources
A comma-separated list of issue sources. Possible values are: AI Security Posture, API Posture Scanner, API Traffic Monitor, ASM, Agentless Disk Scanner, Attack Path, Attack Surface Test, CAS CVE Scanner, CAS License Scanner, CAS Secret Scanner, CI/CD Risks, CIEM Scanner, CLI Scanner, CSPM Scanner, Cloud Network Analyzer, Compute Policy, Correlation, Custom Alert, Data Policy, Health, IaC Scanner, IoT Security, Kubernetes Scanner, PAN NGFW, Package Operational Risk, Prisma Cloud, Prisma Cloud Compute, SAST Scanner, SaaS Attachments, Secrets Scanner, Threat Intelligence, Vulnerability Policy, XDR Agent, XDR Analytics, XDR Analytics BIOC, XDR BIOC, XDR IOC, XDR Managed Threat Hunting.
Optional
issue_action_status
The issue action status.
Optional
action_local_ports
A comma-separated list of local ports for the connection.
Optional
action_remote_ports
A comma-separated list of remote ports for the connection.
Optional
dst_action_external_hostnames
A comma-separated list of destination hostnames to connect to.
Optional
sort_field
The field by which to sort the results. Default is source_insert_ts.
Optional
sort_order
The order in which to sort the results. Possible values are: DESC, ASC. Default is DESC.
Optional
page
The page number of issues to return for pagination. Default is 0.
Optional
page_size
The number of issues to return per page. Default is 50.
Optional
start_time
The start time to filter by. Supports an epoch timestamp or the simplified extended ISO format (YYYY-MM-DDThh🇲🇲ss).
Optional
end_time
The end time to filter by. Supports an epoch timestamp or the simplified extended ISO format (YYYY-MM-DDThh🇲🇲ss).
Optional
starred
Whether the issue is starred. Possible values are: true, false.
Optional
mitre_technique_id_and_names
A comma-separated list of MITRE attack techniques.
Optional
issue_categories
A comma-separated list of issue categories.
Optional
issue_domains
A comma-separated list of issue domains. Possible values are: Health, Hunting, IT, Posture, Security.
Optional
issue_descriptions
A comma-separated list of issue descriptions.
Optional
os_actor_process_image_sha256
A comma-separated list of SHA256 hashes of the OS actor process image.
Optional
action_file_macro_sha256
A comma-separated list of SHA256 hashes of the action file macro.
Optional
status
A comma-separated list of status progress values. Possible values are: New, In Progress, Resolved.
Optional
not_status
A comma-separated list of status progress values to exclude. Possible values are: New, In Progress, Resolved.
Optional
asset_ids
A comma-separated list of asset IDs related to the issue.
Optional
assignees
A comma-separated list of either assignee emails or names, not both. Use "unassigned" for unassigned issues or "assigned" for all assigned issues.
Optional
output_keys
A comma-separated list of outputs to include in the context.
Optional
user_names
A comma-separated list of names assigned to the user ID during agent runtime.
Optional
actor_process_image_names
A comma-separated list of binary file names.
Optional
causality_actor_process_image_command_lines
A comma-separated list of causality graph object command lines.
Optional
actor_process_image_command_line
The command line used by the process image initiated by the causality actor.
Optional
action_process_image_command_lines
A comma-separated list of command lines of the created process.
Optional
actor_process_image_sha256
A comma-separated list of SHA256 hashes of the binary file.
Optional
causality_actor_process_image_sha256
A comma-separated list of SHA256 hashes of the binary file.
Optional
action_process_image_sha256
A comma-separated list of SHA256 hashes of the binary file.
Optional
action_file_image_sha256
A comma-separated list of SHA256 hashes of the file related to the event.
Optional
action_registry_names
A comma-separated list of registry names.
Optional
action_registry_key_data
A comma-separated list of registry key data values.
Optional
host_ips
A comma-separated list of host IP addresses.
Optional
action_local_ips
A comma-separated list of local IP addresses for the connection.
Optional
action_remote_ips
A comma-separated list of remote IP addresses for the connection.
Optional
Outputs
Core.Issue.internal_id string
The unique ID of the issue.
Core.Issue.source_insert_ts number
The detection timestamp.
Core.Issue.issue_name string
The name of the issue.
Core.Issue.severity string
The severity of the issue.
Core.Issue.status string
The status of the issue.
Core.Issue.issue_category string
The category of the issue.
Core.Issue.issue_action_status_readable string
The issue action status in readable format.
Core.Issue.issue_description string
The issue description.
Core.Issue.agent_ip_addresses string
The host IP address.
Core.Issue.agent_hostname string
The hostname.
Core.Issue.Identity_type string
The identity type of the account.
Core.Issue.agent_id string
The agent (endpoint) ID associated with the issue.
Core.Issue.asset_ids string
The asset IDs related to the issue.
Core.Issue.issue_domain string
The domain of the issue.
Core.Issue.case_ids number
The case IDs associated with the issue.
Core.Issue.issue_source string
The source of the issue.
Core.Issue.starred boolean
Whether the issue is starred.
Core.Issue.assigned_to_pretty string
The pretty name of the user assigned to the issue.
Core.Issue.assigned_to string
The user assigned to the issue.
Core.Issue.mitre_tactic_id_and_name string
The MITRE attack tactic.
Core.Issue.mitre_technique_id_and_name string
The MITRE attack technique.
Core.Issue.issue_action_status string
The issue action status.
Core.Issue.action_file_macro_sha256 string
File Macro SHA256 hash of the action file macro.
Core.Issue.action_process_image_sha256 string
Action process image SHA256 hash.
Core.Issue.causality_actor_process_image_sha256 string
Causality actor process image SHA256 hash.
Core.Issue.os_actor_process_image_sha256 string
OS Parent SHA256 hash of the OS actor process image.
Core.Issue.actor_process_image_sha256 string
Actor process image SHA256 hash.
Core.IssueMetadata.returned_count number
The actual number of issues that match all filter criteria and returned in this specific response.
Core.IssueMetadata.filtered_count number
The total number of issues in the system that match all filter criteria.
updateIssue
Updates the properties of an issue. This command does not provide an explicit indication of success.
Arguments
id
Issue ID to update.
Required
assigned_user_mail
Email address of the user to assign the issue to.
Optional
severity
Change the severity of an issue. Possible values are: low, medium, high, critical.
Optional
name
Change the issue name.
Optional
occurred
Change the occurred time of an issue. Supports different time formats, for example: 3 days ago, 2017-09-27T10:00:00+03:00.
Optional
phase
Change the phase of an issue. Possible values are: Triage, Investigation, Containment, Response.
Optional
type
Change the type of an issue.
Optional
description
Change the description of an issue.
Optional
status
Change the status of an issue. Possible values are: New, In Progress, Resolved - Known Issue, Resolved - Duplicate Issue, Resolved - False Positive, Resolved - other, Resolved - True Positive, Resolved - Security Testing, Resolved - Dismissed, Resolved - Fixed, Resolved - Risk Accepted.
Optional
link_cases
A comma-separated list of case IDs to link the issue to.
Optional
unlink_cases
A comma-separated list of case IDs to unlink the issue from.
Optional
Outputs
There are no outputs for this command.
getIssueRecommendations
Returns comprehensive recommendations for one or more issues, including remediation steps, playbook suggestions, and recommended quick actions.
Arguments
issue_ids
A comma-separated list of issue IDs to get recommendations for (maximum 10 per request).
Required
Outputs
Core.IssueRecommendations.IssueID string
The unique identifier of the issue.
Core.IssueRecommendations.IssueName string
The name of the issue.
Core.IssueRecommendations.Severity string
The severity of the issue.
Core.IssueRecommendations.Description string
The description of the issue.
Core.IssueRecommendations.Remediation unknown
The remediation steps for the issue, or a list of remediation techniques.
Core.IssueRecommendations.NetworkReachability unknown
The network reachability information for the issue.
Core.IssueRecommendations.PlaybookSuggestions.PlaybookID string
The ID of the suggested playbook.
Core.IssueRecommendations.PlaybookSuggestions.SuggestionRuleID string
The ID of the suggestion rule.
Core.IssueRecommendations.PlaybookSuggestions.Name string
The name of the suggested playbook.
Core.IssueRecommendations.PlaybookSuggestions.Comment string
A comment about the suggested playbook.
Core.IssueRecommendations.QuickActionSuggestions.Name string
The name of the suggested quick action.
Core.IssueRecommendations.QuickActionSuggestions.SuggestionRuleID string
The ID of the suggestion rule.
Core.IssueRecommendations.QuickActionSuggestions.Brand string
The brand of the suggested quick action.
Core.IssueRecommendations.QuickActionSuggestions.Category string
The category of the suggested quick action.
Core.IssueRecommendations.QuickActionSuggestions.Description string
The description of the suggested quick action.
Core.IssueRecommendations.QuickActionSuggestions.PrettyName string
The display name of the suggested quick action.
Core.IssueRecommendations.QuickActionSuggestions.Arguments.Name string
Name
Core.IssueRecommendations.QuickActionSuggestions.Arguments.PrettyName string
PrettyName
Core.IssueRecommendations.QuickActionSuggestions.Arguments.PrettyPredefined string
PrettyPredefined
Core.IssueRecommendations.QuickActionSuggestions.Arguments.Description string
Description
Core.IssueRecommendations.QuickActionSuggestions.Arguments.Required unknown
Required
Core.IssueRecommendations.ExistingCodeBlock string
The existing code block (AppSec issues only).
Core.IssueRecommendations.SuggestedCodeBlock string
The suggested code block (AppSec issues only).
getRawAlerts
Returns the full original alert data that caused the creation of the specified issues.
Arguments
issue_ids
A comma-separated list of issue IDs to retrieve the original alerts for.
Required
events_from_decider_format
Whether to return the events_from_decider context output as a dictionary (the raw API response) or as a list (improved for playbook automation). Possible values are: list, dict. Default is dict.
Optional
dynamic_analysis
Whether to additionally return the dynamic analysis of each issue under Core.DynamicAnalysis, alongside the original alert data under Core.OriginalAlert. Possible values are: true, false. Default is false.
Optional
getHealthIssues
Returns a list of tenant health issues based on the provided filter criteria.
Arguments
severity
A comma-separated list of severity levels to filter by. Possible values are: info, low, medium, high, critical, unknown.
Optional
type
A comma-separated list of issue types to filter by. Possible values are: Ingestion, Collection, Parsing, Event Forwarding, Correlation, Permissions, Discovery, Registry, Agentless Disk Scanning, Data Security Scanning, Automation.
Optional
time_frame
Returns health issues whose insert timestamp is greater than or equal to this value. Accepts a relative value (e.g. "7 days ago"), an absolute ISO date (e.g. "2024-01-01T00:00:00Z"), or epoch milliseconds. Default is 7 days ago.
Optional
filter_object
A JSON string representing a raw filter object. If provided, this overrides all other filter arguments.
Optional
limit
The maximum number of health issues to return. Default is 50.
Optional
page_size
The number of health issues to return per page. When set, manual pagination is used and limit is ignored.
Optional
page
The page number to return, starting from zero. When set, manual pagination is used and limit is ignored.
Optional
Last updated
Was this helpful?