> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.9/configure-cortex-xsoar/integrations/add-an-integration-instance/fetch-incidents-from-an-integration-instance.md).

# Fetch incidents from an integration instance

You can poll third-party integration instances for events and turn them into Cortex XSOAR incidents (fetching). Many integrations support fetching, but not all support this feature. You can view each integration in the [Developer Hub](https://xsoar.pan.dev/docs/reference/index).

When setting up an instance, you can configure the integration instance to fetch events. You can also set the interval for which to fetch new incidents, by configuring the **Incidents Fetch Interval** field. The fetch interval default is 1 minute. This enables you to control the interval in which an integration instance reaches out to third-party platforms to fetch incidents into Cortex XSOAR.

{% hint style="info" %}

### Note

* In some integrations, the **Incidents Fetch interval** is called **Feed Fetch Interval**.
* If the integration instance does not have the **Incidents Fetch Interval** field, you need to add this field by editing the integration settings. If the integration is from a content pack, you need to create a copy of the integration. Any future updates to this integration will not be applied to the copy integration.
* If you turn off fetching for a while and then turn it on or disable the instance and enable it, the instance remembers the last run and pulls all events that occurred while it was off. If you don't want this to happen, verify that the instance is enabled and click **Reset the “last run” timestamp** when editing the instance. Also, note that "last run" is retained when an instance is renamed.
  {% endhint %}

How to fetch incidents from an integration

1. Select the integration instance you want to fetch incidents by going to Settings & Info → Settings → Integrations → **Instances** finding the integration and clicking **+ Add instance**.
2. Select **Fetches incidents**.

   When enabled, Cortex XSOAR searches for events that occurred within the time frame set for the integration, which is based on the specific integration. The default is 10 minutes prior but can be changed in the integration script.
3. (Optional) In the **Incidents Fetch Interval** field, set the interval of hours and minutes to fetch incidents (default 1 minute).
4. (Optional) If the **Incidents Fetch Interval** field does not appear, add it to the integration.

   Relevant for any incident fetching integration.

   1. For integrations installed from a content pack, select the duplicate integration button.

      If you already duplicated the integration, click the Edit integration’s source button.
   2. In the **Basic** section, select the **Fetches incidents** checkbox.

      In the **Parameters** section, you can see that the **`IncidentFetchInterval`** parameter is added. Change the default value if necessary.
   3. **Save** the changes.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.9/configure-cortex-xsoar/integrations/add-an-integration-instance/fetch-incidents-from-an-integration-instance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.