> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/incident-management.md).

# Incident Management

APIs for managing incidents

## Get all Incidents

> Get a list of incidents filtered by a list of incident IDs, modification time, or creation time. This includes all incident types and severities, including correlation-generated incidents.\
> \- The response is concatenated using AND condition (OR is not supported).\
> \- The maximum result set size is >100.\
> \- Offset is the zero-based number of incidents from the start of the result set.\
> \
> Note: You can send a request to retrieve either \*\*all\*\* or \*\*filtered\*\* results.\
> \
> Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/incidents/get_incidents":{"post":{"operationId":"postGetIncidents","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Get all Incidents","description":"Get a list of incidents filtered by a list of incident IDs, modification time, or creation time. This includes all incident types and severities, including correlation-generated incidents.\n- The response is concatenated using AND condition (OR is not supported).\n- The maximum result set size is >100.\n- Offset is the zero-based number of incidents from the start of the result set.\n\nNote: You can send a request to retrieve either **all** or **filtered** results.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.\nAn empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"Identifies the incident field the filter is matching. Filters are based on the following keywords:\n- `modification_time`: Time the incident has been modified.\n- `creation_time`: Incident's creation time.\n- `incident_id`: Incident ID.\n- `incident_id_list`: List of incident IDs.\n- `description`: Incident description.\n- `alert_sources`: Source that detected the alert.\n- `status`: The status of the incident.\n- `starred`: Whether the incident is starred.","enum":["modification_time","creation_time","incident_id_list","description","alert_sources","status","incident_id","starred"]},"operator":{"type":"string","description":"Identifies the comparison operator you want to use for this filter. Valid keywords are:\n`in`: \n- `incident_id_list`, `alert_sources`, `description`: List of Strings\n`contains`\n- `description`: String\n`gte` / `lte`\n- `modification_time`, `creation_time`: Integer in timestamp epoch milliseconds\n`eq` / `neq`\n- `status`: String\n- `starred`: Boolean\n","enum":["in","contains","gte","lte","eq","neq"]},"value":{"type":["array","integer","string","boolean"],"description":"Value that this filter must match. The contents of this field will differ depending on the incident field that you specified for this filter:\n- `modification_time`, `creation_time`: Integer representing the number of milliseconds after the Unix epoch, UTC timezone.\n- `description`: List of strings.\n- `incident_id`: String.\n- `incident_id_list`: List of strings. Each item in the list muste be an incident ID.\n- `alert_sources`: List of strings.\n- `status`: Single value, can be one of the following: `resolved_duplicate`, `resolved_other`, `new`, `resolved_security_testing`, `resolved_known_issue`, `resolved_auto`, `resolved_threat_handled`, `resolved_true_positive`, `under_investigation`, or `resolved_false_positive`.\n- `starred`: Boolean value: `true` or `false`.","items":{}}}}},"search_from":{"type":"integer","description":"Integer representing the starting offset within the query result set from which you want incidents returned.\nIncidents are returned as a zero-based list. Any incident indexed less than this value is not returned in the final result set and defaults to zero."},"search_to":{"type":"integer","description":"Integer representing the end offset within the result set after which you do not want incidents returned.\nIncidents in the incident list that are indexed higher than this value are not returned in the final results set. Defaults to >100, which returns all incidents to the end of the list."},"sort":{"type":"object","description":"Identifies the sort order for the result set.","required":["field","keyword"],"properties":{"field":{"description":"Sort according to this field. Valid options are: \r\n- `creation_time`\r\n- `incident_id`\r\n- `modification_time`","enum":["creation_time","incident_id","modification_time"]},"keyword":{"type":"string","enum":["asc","desc"],"description":"Sort in ascending or descending order."}}}}}}}}},"description":"If no parameters are included, all results will be returned."},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer","description":"The total number of possible results.","maximum":10000},"result_count":{"type":"integer","description":"The number of incidents actually returned as result."},"incidents":{"type":"array","description":"A list of incidents.\n\nNote: If a manual_description was set, the description field will display the manual description and the system description is not returned.\n\nDepending on the defined user permissions, with full permissions, the response displays original_tags and tags fields.","items":{"type":"object","properties":{"incident_id":{"type":"string"},"incident_name":{"type":"string"},"creation_time":{"type":"integer"},"modification_time":{"type":"integer"},"detection_time":{"nullable":true},"status":{"type":"string"},"severity":{"type":"string"},"description":{"type":"string"},"assigned_user_mail":{"nullable":true},"assigned_user_pretty_name":{"nullable":true},"alert_count":{"type":"integer"},"low_severity_alert_count":{"type":"integer"},"med_severity_alert_count":{"type":"integer"},"high_severity_alert_count":{"type":"integer"},"critical_severity_alert_count":{"type":"integer"},"user_count":{"type":"integer"},"host_count":{"type":"integer"},"notes":{"nullable":true},"resolve_comment":{"nullable":true},"resolved_timestamp":{"type":"integer"},"manual_severity":{"nullable":true},"manual_description":{"type":"string"},"xdr_url":{"type":"string"},"starred":{"type":"boolean"},"starred_manually":{"type":"boolean","description":"True = this incident was manually starred.\r\nFalse = This incident was starred by starring rules."},"hosts":{"type":"array","items":{"type":"string"}},"users":{"type":"array","items":{"type":"string"}},"incident_sources":{"type":"array","items":{"type":"string"}},"rule_based_score":{"type":"integer"},"manual_score":{"nullable":true},"wildfire_hits":{"type":"integer"},"alerts_grouping_status":{"type":"string"},"mitre_tactics_ids_and_names":{"type":"array","items":{"type":"string"}},"mitre_techniques_ids_and_names":{"type":"array","items":{"type":"string"}},"alert_categories":{"type":"array","items":{"type":"string"}},"original_tags":{"type":"array","items":{"type":"string"}},"tags":{"type":"array","items":{"type":"string"}}}}},"restricted_incident_ids":{"type":"array","description":"Depending on the defined user permissions, in restrictive or partial permission mode, the response displays only the incident ID. For example:\n\n\"restricted_incident_ids\": [ \"1491\"]","items":{"type":"object"}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get all Alerts

> Get a list of all or filtered alerts. The alerts listed are what remains after alert exclusions are applied by Cortex XDR.
> \\
>
> \
> \- Response is concatenated using AND condition (OR is not supported).
> \
> \- Maximum result set size is 100.
> \
> \- Offset is the zero-based number of alerts from the start of the result set.
> \
> The response indicates whether an PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.
> \\
>
> \
> Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/alerts/get_alerts":{"post":{"summary":"Get all Alerts","tags":["Incident Management"],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer","description":"Number of total results of this filter without paging. If filter returned 10,000 results or more than 9,999 will be the value and you can use paging to view the entire set of data."},"result_count":{"type":"integer","description":"Number of alerts actually returned as result."},"alerts":{"type":"array","items":{"type":"object","properties":{"external_id":{"type":"string"},"severity":{"type":"string"},"matching_status":{"type":"string"},"end_match_attempt_ts":{"type":"integer"},"local_insert_ts":{"type":"integer"},"bioc_indicator":{"nullable":true},"matching_service_rule_id":{"nullable":true},"attempt_counter":{"type":"integer"},"bioc_category_enum_key":{"nullable":true},"is_whitelisted":{"type":"boolean"},"starred":{"type":"boolean"},"deduplicate_tokens":{"nullable":true},"filter_rule_id":{"nullable":true},"mitre_technique_id_and_name":{"type":"array","items":{"type":"string"}},"mitre_tactic_id_and_name":{"type":"array","items":{"type":"string"}},"agent_version":{"type":"string"},"agent_device_domain":{"nullable":true},"agent_fqdn":{"type":"string"},"agent_os_type":{"type":"string"},"agent_os_sub_type":{"type":"string"},"agent_data_collection_status":{"type":"boolean"},"mac":{"nullable":true},"mac_address":{"type":"array","items":{"type":"string"}},"agent_is_vdi":{"nullable":true},"contains_featured_host":{"type":"boolean"},"contains_featured_user":{"type":"boolean"},"contains_featured_ip":{"type":"boolean"},"events":{"type":"array","items":{"type":"object","properties":{"agent_install_type":{"type":"string"},"agent_host_boot_time":{"nullable":true},"event_sub_type":{"nullable":true},"module_id":{"type":"string"},"association_strength":{"nullable":true},"dst_association_strength":{"nullable":true},"story_id":{"nullable":true},"event_id":{"nullable":true},"event_type":{"type":"string"},"event_timestamp":{"type":"integer"},"actor_process_instance_id":{"type":"string"},"actor_process_image_path":{"type":"string"},"actor_process_image_name":{"type":"string"},"actor_process_command_line":{"type":"string"},"actor_process_signature_status":{"type":"string"},"actor_process_signature_vendor":{"nullable":true},"actor_process_image_sha256":{"type":"string"},"actor_process_image_md5":{"nullable":true},"actor_process_causality_id":{"nullable":true},"actor_causality_id":{"nullable":true},"actor_process_os_pid":{"type":"string"},"actor_thread_thread_id":{"nullable":true},"causality_actor_process_image_name":{"nullable":true},"causality_actor_process_command_line":{"nullable":true},"causality_actor_process_image_path":{"nullable":true},"causality_actor_process_signature_vendor":{"nullable":true},"causality_actor_process_signature_status":{"type":"string"},"causality_actor_causality_id":{"nullable":true},"causality_actor_process_execution_time":{"nullable":true},"causality_actor_process_image_md5":{"nullable":true},"causality_actor_process_image_sha256":{"nullable":true},"action_file_path":{"nullable":true},"action_file_name":{"nullable":true},"action_file_md5":{"nullable":true},"action_file_sha256":{"nullable":true},"action_file_macro_sha256":{"nullable":true},"action_registry_data":{"nullable":true},"action_registry_key_name":{"nullable":true},"action_registry_value_name":{"nullable":true},"action_registry_full_key":{"nullable":true},"action_local_ip":{"nullable":true},"action_local_port":{"nullable":true},"action_remote_ip":{"nullable":true},"action_remote_port":{"nullable":true},"action_external_hostname":{"nullable":true},"action_country":{"type":"string"},"action_process_instance_id":{"nullable":true},"action_process_causality_id":{"nullable":true},"action_process_image_name":{"nullable":true},"action_process_image_sha256":{"nullable":true},"action_process_image_command_line":{"nullable":true},"action_process_signature_status":{"type":"string"},"action_process_signature_vendor":{"nullable":true},"os_actor_effective_username":{"nullable":true},"os_actor_process_instance_id":{"nullable":true},"os_actor_process_image_path":{"nullable":true},"os_actor_process_image_name":{"nullable":true},"os_actor_process_command_line":{"nullable":true},"os_actor_process_signature_status":{"type":"string"},"os_actor_process_signature_vendor":{"nullable":true},"os_actor_process_image_sha256":{"nullable":true},"os_actor_process_causality_id":{"nullable":true},"os_actor_causality_id":{"nullable":true},"os_actor_process_os_pid":{"nullable":true},"os_actor_thread_thread_id":{"nullable":true},"fw_app_id":{"nullable":true},"fw_interface_from":{"nullable":true},"fw_interface_to":{"nullable":true},"fw_rule":{"nullable":true},"fw_rule_id":{"nullable":true},"fw_device_name":{"nullable":true},"fw_serial_number":{"nullable":true},"fw_url_domain":{"nullable":true},"fw_email_subject":{"nullable":true},"fw_email_sender":{"nullable":true},"fw_email_recipient":{"nullable":true},"fw_app_subcategory":{"nullable":true},"fw_app_category":{"nullable":true},"fw_app_technology":{"nullable":true},"fw_vsys":{"nullable":true},"fw_xff":{"nullable":true},"fw_misc":{"nullable":true},"fw_is_phishing":{"type":"string"},"dst_agent_id":{"nullable":true},"dst_causality_actor_process_execution_time":{"nullable":true},"dns_query_name":{"nullable":true},"dst_action_external_hostname":{"nullable":true},"dst_action_country":{"nullable":true},"dst_action_external_port":{"nullable":true},"user_name":{"nullable":true}}}},"alert_id":{"type":"string"},"detection_timestamp":{"type":"integer"},"name":{"type":"string"},"category":{"type":"string"},"endpoint_id":{"type":"string"},"description":{"type":"string"},"host_ip":{"type":"array","items":{"type":"string"}},"host_name":{"type":"string"},"source":{"type":"string"},"action":{"type":"string"},"action_pretty":{"type":"string"},"variation_rule_id":{"type":"string"}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON."},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters."},"402":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal server error. A unified status for API communication type errors."}},"operationId":"post-public_api-v1-alerts-get_alerts","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"description":"Get a list of all or filtered alerts. The alerts listed are what remains after alert exclusions are applied by Cortex XDR.\r\n\r\n- Response is concatenated using AND condition (OR is not supported).\r\n- Maximum result set size is 100.\r\n- Offset is the zero-based number of alerts from the start of the result set.\r\nThe response indicates whether an PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.\r\n\r\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"description":"If no parameters are included, all results will be returned.","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"enum":["alert_id_list","alert_source","severity","creation_time","server_creation_time"],"description":"Identifies the alert field the filter is matching. Filters are based on the following keywords:\r\n- `alert_id_list`: List of integers representing the alert IDs.\r\n- `alert_source`: List of strings representing the alert sources.\r\n- `severity`: List of strings representing the alert severities.\r\n- `creation_time`: Timestamp of when the alert was originally identified.\r\n- `server_creation_time`: Timestamp of when the alert was stored in the database."},"operator":{"enum":["in","gte","lte"],"description":"Identifies the comparison operator you want to use for this filter. Valid keywords are:\r\n`in`: \r\n- `alert_id_list`, `alert_source`, and `severity`\r\n`gte` / `lte`\r\n- `creation_time` and `server_creation_time`"},"value":{"type":["string","array","integer"],"description":"Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter:\r\n- `creation_time`: Integer representing the number of seconds or milliseconds after the Unix epoch, UTC timezone. The value is returned in the response under the `detection_timestamp` field, and represented in console under the TIMESTAMP field.\r\n- `server_creation_time`: Integer representing the number of seconds or milliseconds after the Unix epoch, UTC timezone. The value is represented in XQL as `local_insert_ts`.\r\n- `alert_id_list`: Array of integers. Each item in the list must be an alert ID.\r\n- `severity`: Valid values are `low`, `medium`, `high`, `critical`.","items":{}}}}},"search_from":{"type":"integer","description":"An integer representing the starting offset within the query result set from which you want alerts returned.\r\nAlerts are returned as a zero-based list. Any alert indexed less than this value is not returned in the final result set and defaults to zero."},"search_to":{"type":"integer","description":"An integer representing the end offset within the result set after which you do not want alerts returned.\r\nAlerts in the alerts list that are indexed higher than this value are not returned in the final results set. Defaults to 100, which returns all alerts to the end of the list."},"sort":{"type":"object","description":"Identifies the sort order for the result set. By default the sort is defined as *creation_time*, *desc*.","required":["keyword"],"properties":{"field":{"type":"string","description":"Identifies how to sort the result set, either according to severity or creation time. "},"keyword":{"type":"string","description":"Defines whether to sort the results in ascending (asc) or descending (desc) order."}}}}}}}}}}}}}}
```

## Update an Incident

> Update one or more fields of a specific incident. Missing fields are ignored.\
> Note the following:\
> \- \`assigned\_user\_mail\` field is validated by Cortex XDR to confirm the provided assignee email address belongs to a user that exists in the same Cortex XDR tenant.\
> \- To unassign an incident pass \`none\` or \`”assigned\_user\_mail”: “”\`.\
> \- To remove a manually set severity pass \`none\` or \`“manual\_severity”: “”\`.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/incidents/update_incident":{"post":{"operationId":"postUpdateIncident","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Update an Incident","description":"Update one or more fields of a specific incident. Missing fields are ignored.\nNote the following:\n- `assigned_user_mail` field is validated by Cortex XDR to confirm the provided assignee email address belongs to a user that exists in the same Cortex XDR tenant.\n- To unassign an incident pass `none` or `”assigned_user_mail”: “”`.\n- To remove a manually set severity pass `none` or `“manual_severity”: “”`.","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["incident_id","update_data"],"properties":{"incident_id":{"type":"string","description":"A string representing the incident ID you want to update."},"update_data":{"type":"object","description":"The data to update the incident with.","properties":{"assigned_user_mail":{"type":"string","description":"Updated email address of the incident assignee."},"manual_severity":{"type":"string","description":"Administrator-defined severity.Updated incident status."},"status":{"type":"string","description":"Updated incident status."},"resolve_comment":{"type":"string","description":"Descriptive comment explaining the incident change. This can be set only for resolved incidents."},"comment":{"type":"object","description":"Add a comment to the incident.","required":["comment_action","value"],"properties":{"comment_action":{"type":"string","description":"The comment action must be 'add'."},"value":{"type":"string","description":"The comment text."}}},"<custom_fields>":{"type":"string","description":"You can include custom incident fields in the request. The names of the custom fields are standardized into lowercase with no white spaces. \r\nor example, `Single Select` would be included as `singleselect`."},"notes":{"type":"string","description":"Notes for the incident. If there are already notes, these notes will replace existing notes."}}}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"Whether the incident update was successful."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors. For example, test@test.com is not a valid Cortex XDR email address.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Update Alerts

> Update one or more alerts. You can update up to 100 alerts per request. Missing fields are ignored.\
> \
> Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/alerts/update_alerts":{"post":{"operationId":"postUpdateAlerts","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Update Alerts","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","required":["alert_id_list","update_data"],"properties":{"alert_id_list":{"type":"array","description":"A list representing the alert IDs you want to update.","items":{"type":"string"}},"update_data":{"type":"object","description":"The data you want to update the alerts with.","properties":{"severity":{"description":"Alert severity.","enum":["critical","high","medium","low","informational"]},"status":{"description":"Updated alert status.","enum":["new","under_investigation","resolved_security_testing","resolved_known_issue","resolved_duplicate","resolved_other","resolved_false_positive","resolved_true_positive"]},"comment":{"type":"string","description":"Descriptive comment explaining the changes."}}}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"array","description":"IDs of alerts that were updated.","items":{"type":"string"}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors. For example, test@test.com is not a valid Cortex XDR email address.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"description":"Update one or more alerts. You can update up to 100 alerts per request. Missing fields are ignored.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**"}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Insert CEF Alerts

> Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views.\
> You can send 600 alerts per minute.\
> \
> Required license: \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/alerts/insert_cef_alerts":{"post":{"operationId":"postInsertCefAlerts","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Insert CEF Alerts","description":"Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views.\nYou can send 600 alerts per minute.\n\nRequired license: **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"alerts":{"type":"array","description":"A list of alerts in CEF format.","items":{"type":"string"}}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=upload successful"}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Insert Parsed Alerts

> Upload alerts from external alert sources in Cortex XDR format. Cortex XDRdisplays alerts that are parsed successfully in related incidents and views.\
> You can send 600 alerts per minute. Each request can contain a maximum of 60 alerts.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/alerts/insert_parsed_alerts":{"post":{"operationId":"postInsertParsedAlerts","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Insert Parsed Alerts","description":"Upload alerts from external alert sources in Cortex XDR format. Cortex XDRdisplays alerts that are parsed successfully in related incidents and views.\nYou can send 600 alerts per minute. Each request can contain a maximum of 60 alerts.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"alerts":{"type":"array","description":"The external alerts you want to upload to Cortex XDR.","items":{"type":"object","properties":{"product":{"type":"string"},"vendor":{"type":"string"},"local_ip":{"type":"string"},"local_port":{"type":"string"},"remote_ip":{"type":"string"},"remote_port":{"type":"string"},"event_timestamp":{"type":"integer"},"severity":{"type":"string"},"alert_name":{"type":"string"},"alert_description":{"type":"string"},"action_status":{"type":"string"},"local_ip_v6":{"type":"string"},"remote_ip_v6":{"type":"string"}}}}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=upload successful"}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Retrieve PCAP Packet

> Retrieve a list of alert IDs and the associated PCAP triggering packets of PAN NGFW type alerts returned when running the \*\*Get Alerts\*\* and \*\*Get Extra Incident Data\*\* APIs. Maximum result set size is 100.\
> \
> Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\*<br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/alerts/get_alerts_pcap":{"post":{"operationId":"postGetAlertsPcap","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Retrieve PCAP Packet","description":"Retrieve a list of alert IDs and the associated PCAP triggering packets of PAN NGFW type alerts returned when running the **Get Alerts** and **Get Extra Incident Data** APIs. Maximum result set size is 100.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**\n","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"description":"Identifies the alert field the filter is matching. Filters are based on the following keywords:\r\n- `alert_id_list`: List of integers of the Alert ID\r\n- `alert_source`: List of strings of the Alert source\r\n- `severity`: List of strings of the Alert severity\r\n- `creation_time`: Integer of the Creation time","enum":["alert_id_list","alert_source","severity","creation_time"]},"operator":{"description":"String that identifies the comparison operator you want to use for this filter. Values keywords:\r\n`in`: \r\n- `alert_id`, `alert_source`, and `severity`.\r\n`gte` or `lte`: \r\n- `creation_time`.","enum":["in","gte","lte"]},"value":{"type":["array","integer"],"description":"Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter:\r\n- `creation_time`: Integer representing the number of seconds or milliseconds after the Unix epoch, UTC timezone. The value is returned in the response under the `detection_timestamp` field, and represented in console under the TIMESTAMP field.\r\n- `alert_id_list`: List of integers. Each item in the list must be an alert ID.\r\n- `severity`: Valid values are `low`, `medium`, `high`, `critical`, `informational`, `unknown`.","items":{"type":["integer","string"]}}},"required":["field","operator","value"]}},"search_from":{"type":"string","description":"An integer representing the starting offset within the query result set from which you want alerts returned.\r\nAlerts are returned as a zero-based list. Any alert indexed less than this value is not returned in the final result set and defaults to zero."},"search_to":{"type":"string","description":"An integer representing the end offset within the result set after which you do not want alerts returned.\r\nAlerts in the alerts list that are indexed higher than this value are not returned in the final results set. Defaults to 100, which returns all alerts to the end of the list."},"sort":{"type":"object","description":"Identifies the sort order for the result set. By default the sort is defined as creation_time, DESC.","properties":{"field":{"description":"The field you want to sort by.","enum":["creation_time","severity"]},"keyword":{"description":"Whether to sort in ascending or descending order.","enum":["asc","desc"]}},"required":["field","keyword"]}}}}}}},"description":"Note: You can send a request to retrieve either all or filtered results."},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer","description":"Number of total results of this filter without paging. If filter returned 10,000 results or more than 9,999 will be the value and you can use paging to view the entire set of data."},"result_count":{"type":"integer","description":"Number of alerts actually returned as result."},"alerts":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"pcap_data":{"type":"string","description":"For alerts without PCAP data an empty string is returned."}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Alerts Multi-Events v2

> Get a list of alerts with multiple events.\
> \- The response is concatenated using AND condition (OR is not supported).\
> \- The maximum result set size is 100.\
> \- Offset is the zero-based number of alerts from the start of the result set.\
> \
> Cortex XDR displays in the API response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the \*\*Retrieve PCAP Packet\*\* API to retrieve a list of alert IDs and their associated PCAP data.\
> \
> Note: You can send a request to retrieve either all or filtered results.\
> \
> Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v2/alerts/get_alerts_multi_events":{"post":{"summary":"Get Alerts Multi-Events v2","tags":["Incident Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"total_count":{"type":"integer","description":"The number of total results returned by this filter without paging. If the filter returns more than 9,999 the total_count value returned will be 9.999. You can use paging to view the entire set of data."},"result_count":{"type":"integer","description":"The number of alerts actually returned as results."},"alerts":{"type":"array","description":"A list of alerts.","items":{"type":"object","properties":{"agent_os_sub_type":{"type":"string"},"fw_app_category":{"nullable":true},"fw_app_id":{"nullable":true},"fw_app_subcategory":{"nullable":true},"fw_app_technology":{"nullable":true},"category":{"type":"string"},"causality_actor_process_command_line":{"type":"array","items":{"type":"string"}},"causality_actor_process_image_md5":{"type":"array","items":{"type":"string"}},"causality_actor_process_image_name":{"type":"array","items":{"type":"string"}},"causality_actor_process_image_path":{"type":"array","items":{"type":"string"}},"causality_actor_process_image_sha256":{"type":"array","items":{"type":"string"}},"causality_actor_process_signature_status":{"type":"array","items":{"type":"string"}},"causality_actor_process_signature_vendor":{"type":"array","items":{"type":"string"}},"causality_actor_causality_id":{"type":"array","items":{"type":"string"}},"identity_sub_type":{"nullable":true},"identity_type":{"nullable":true},"operation_name":{"nullable":true},"project":{"nullable":true},"cloud_provider":{"nullable":true},"referenced_resource":{"nullable":true},"resource_sub_type":{"nullable":true},"resource_type":{"nullable":true},"cluster_name":{"nullable":true},"container_id":{"nullable":true},"contains_featured_host":{"type":"array","items":{"type":"string"}},"contains_featured_ip":{"type":"array","items":{"type":"string"}},"contains_featured_user":{"type":"array","items":{"type":"string"}},"action_country":{"type":"array","items":{"type":"string"}},"description":{"type":"string"},"fw_interface_to":{"nullable":true},"dns_query_name":{"nullable":true},"agent_device_domain":{"nullable":true},"fw_email_recipient":{"nullable":true},"fw_email_sender":{"nullable":true},"fw_email_subject":{"nullable":true},"event_type":{"type":"array","items":{"type":"string"}},"is_whitelisted":{"type":"boolean"},"action_file_macro_sha256":{"nullable":true},"action_file_md5":{"nullable":true},"action_file_name":{"nullable":true},"action_file_path":{"nullable":true},"action_file_sha256":{"nullable":true},"fw_device_name":{"nullable":true},"fw_rule_id":{"nullable":true},"fw_rule":{"nullable":true},"fw_serial_number":{"nullable":true},"agent_fqdn":{"nullable":true},"agent_os_type":{"type":"string"},"image_name":{"nullable":true},"actor_process_image_name":{"type":"array","items":{"type":"string"}},"actor_process_command_line":{"type":"array","items":{"type":"string"}},"actor_process_image_md5":{"type":"array","items":{"type":"string"}},"actor_process_image_path":{"type":"array","items":{"type":"string"}},"actor_process_os_pid":{"type":"array","items":{"type":"integer"}},"actor_process_image_sha256":{"type":"array","items":{"type":"string"}},"actor_process_signature_status":{"type":"array","items":{"type":"string"}},"actor_process_signature_vendor":{"type":"array","items":{"type":"string"}},"actor_thread_thread_id":{"type":"array","items":{"type":"integer"}},"fw_is_phishing":{"type":"array","items":{"type":"string"}},"action_local_ip":{"nullable":true},"action_local_port":{"nullable":true},"fw_misc":{"nullable":true},"mitre_tactic_id_and_name":{"type":"array","items":{"type":"string"}},"mitre_technique_id_and_name":{"type":"array","items":{"type":"string"}},"module_id":{"nullable":true},"fw_vsys":{"nullable":true},"os_actor_process_command_line":{"type":"array","items":{"type":"string"}},"os_actor_thread_thread_id":{"type":"array","items":{"type":"integer"}},"os_actor_process_image_name":{"type":"array","items":{"type":"string"}},"os_actor_process_os_pid":{"type":"array","items":{"type":"integer"}},"os_actor_process_image_sha256":{"type":"array","items":{"type":"string"}},"os_actor_process_signature_status":{"type":"array","items":{"type":"string"}},"os_actor_process_signature_vendor":{"type":"array","items":{"type":"string"}},"os_actor_effective_username":{"nullable":true},"action_process_signature_status":{"type":"array","items":{"type":"string"}},"action_process_signature_vendor":{"nullable":true},"action_registry_data":{"nullable":true},"action_registry_full_key":{"nullable":true},"action_external_hostname":{"nullable":true},"action_remote_ip":{"nullable":true},"action_remote_port":{"nullable":true},"matching_service_rule_id":{"type":"string"},"fw_interface_from":{"nullable":true},"starred":{"type":"boolean"},"action_process_image_command_line":{"nullable":true},"action_process_image_name":{"nullable":true},"action_process_image_sha256":{"nullable":true},"fw_url_domain":{"nullable":true},"user_agent":{"nullable":true},"fw_xff":{"nullable":true},"external_id":{"type":"string"},"severity":{"type":"string"},"matching_status":{"type":"string"},"end_match_attempt_ts":{"nullable":true},"local_insert_ts":{"type":"integer"},"last_modified_ts":{"nullable":true},"bioc_indicator":{"nullable":true},"attempt_counter":{"type":"integer"},"bioc_category_enum_key":{"nullable":true},"case_id":{"type":"integer"},"deduplicate_tokens":{"nullable":true},"filter_rule_id":{"nullable":true},"agent_version":{"type":"string"},"agent_ip_addresses_v6":{"nullable":true},"agent_data_collection_status":{"nullable":true},"agent_is_vdi":{"type":"boolean"},"agent_install_type":{"type":"string"},"agent_host_boot_time":{"type":"array","items":{"type":"integer"}},"event_sub_type":{"type":"array","items":{"type":"integer"}},"association_strength":{"type":"array","items":{"type":"integer"}},"dst_association_strength":{"nullable":true},"story_id":{"nullable":true},"event_id":{"type":"array","items":{"type":"string"}},"event_timestamp":{"type":"array","items":{"type":"integer"}},"actor_process_instance_id":{"type":"array","items":{"type":"string"}},"actor_process_causality_id":{"type":"array","items":{"type":"string"}},"actor_causality_id":{"type":"array","items":{"type":"string"}},"causality_actor_process_execution_time":{"type":"array","items":{"type":"integer"}},"action_registry_key_name":{"nullable":true},"action_registry_value_name":{"nullable":true},"action_local_ip_v6":{"nullable":true},"action_remote_ip_v6":{"nullable":true},"action_process_instance_id":{"nullable":true},"action_process_causality_id":{"nullable":true},"os_actor_process_instance_id":{"type":"array","items":{"type":"string"}},"os_actor_process_image_path":{"type":"array","items":{"type":"string"}},"os_actor_process_causality_id":{"type":"array","items":{"type":"string"}},"os_actor_causality_id":{"nullable":true},"dst_agent_id":{"type":"array","items":{"type":"string"}},"dst_causality_actor_process_execution_time":{"nullable":true},"dst_action_external_hostname":{"nullable":true},"dst_action_country":{"nullable":true},"dst_action_external_port":{"nullable":true},"is_pcap":{"type":"boolean"},"alert_type":{"type":"string"},"resolution_status":{"type":"string"},"resolution_comment":{"nullable":true},"dynamic_fields":{"nullable":true},"tags":{"type":"array","items":{"type":"string"}},"alert_id":{"type":"string"},"detection_timestamp":{"type":"integer"},"name":{"type":"string"},"endpoint_id":{"type":"string"},"host_ip":{"type":"array","items":{"type":"string"}},"host_name":{"type":"string"},"action":{"type":"string"},"original_tags":{"type":"array","items":{"type":"string"}},"user_name":{"type":"array","items":{"type":"string"}},"mac_addresses":{"nullable":true},"source":{"nullable":true},"action_pretty":{"type":"string"},"variation_rule_id":{"type":"string"}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v2-alerts-get_alerts_multi_events","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"description":"Get a list of alerts with multiple events.\n- The response is concatenated using AND condition (OR is not supported).\n- The maximum result set size is 100.\n- Offset is the zero-based number of alerts from the start of the result set.\n\nCortex XDR displays in the API response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the **Retrieve PCAP Packet** API to retrieve a list of alert IDs and their associated PCAP data.\n\nNote: You can send a request to retrieve either all or filtered results.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.\n\nAn empty dictionary returns all results.","properties":{"filters":{"anyOf":[{"items":{"type":"object","properties":{"field":{"type":"string","enum":["alert_id_list","alert_source","severity","creation_time","server_creation_time"],"description":"Alert field the filter is matching. Filters are based on the following keywords:\n- `alert_id_list`: List of integers of the alert ID\n- `alert_source`: List of strings of the alert source\n- `severity`: List of strings of the alert severity\n- `creation_time`: Timestamp of the creation time\n- `server_creation_time`: Timestamp of when Cortex XDR created the alert"},"operator":{"type":"string","enum":["in","gte","lte"],"description":"Identifies the comparison operator you want to use for this filter. Possible values:\n`in`\n- permitted for `alert_id`, `alert_source`, and `severity`\n- `gte` / `lte`\n- Permitted only for `creation_time'"},"value":{"type":["array","integer"],"description":"Value that the filter must match. The contents of this field differ depending on the alert field that you specified for this filter.","items":{"type":["integer","string"],"enum":["low","medium","high","critical","informational"]}}}}}],"description":"Array of filter fields.","type":"array"}}}}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Alerts Multi-Events v1

> \*\*Note: \*\* This endpoint is legacy. Use the \[Get Alerts Multi-Events v2]\(<https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/incident-management#post-public\\_api-v2-alerts-get\\_alerts\\_multi\\_events>) endpoint.\
> \
> Get a list of alerts with multiple events.\
> \- Response is concatenated using AND condition (OR is not supported).\
> \- Maximum result set size is 100.\
> \- Offset is the zero-based number of alerts from the start of the result set.\
> Cortex XDR displays in the APIs response whether an PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.\
> \
> Note: You can send a request to retrieve either all or filtered results.\
> \
> Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/alerts/get_alerts_multi_events":{"post":{"operationId":"postGetAlertsMultiEvents","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Get Alerts Multi-Events v1","description":"**Note: ** This endpoint is legacy. Use the [Get Alerts Multi-Events v2](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/incident-management#post-public_api-v2-alerts-get_alerts_multi_events) endpoint.\n\nGet a list of alerts with multiple events.\n- Response is concatenated using AND condition (OR is not supported).\n- Maximum result set size is 100.\n- Offset is the zero-based number of alerts from the start of the result set.\nCortex XDR displays in the APIs response whether an PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.\n\nNote: You can send a request to retrieve either all or filtered results.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"enum":["alert_id_list","alert_source","severity","creation_time","server_creation_time","external_id_list"],"description":"Identifies the alert field the filter is matching. Filters are based on the following keywords:\r\n- `alert_id_list`: List of integers representing the alert IDs.\r\n- `alert_source`: List of strings representing the alert sources.\r\n- `severity`: List of strings representing the alert severities.\r\n- `creation_time`: Timestamp of the alert creation time.\r\n- `server_creation_time`: Timestamp of when Cortex XDR created the alert.\r\n- `external_id_list`: List of external IDs."},"operator":{"enum":["in","gte","lte"],"description":"Identifies the comparison operator you want to use for this filter. Valid keywords are:\r\n`in`: \r\n- `alert_id_list`, `alert_source`, `severity`, and `external_id_list`.\r\n`gte` / `lte`\r\n- `creation_time`."},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter:\r\n- `creation_time`: Integer representing the number of seconds or milliseconds after the Unix epoch, UTC timezone. The value is returned in the response under the `detection_timestamp` field, and represented in console under the TIMESTAMP field.\r\n- `alert_id_list`: Array of integers. Each item in the list must be an alert ID.\r\n- `severity`: Valid values are `low`, `medium`, `high`, `critical`.\r\n- `external_id_list`: Array of strings.","type":["integer","array","string"],"items":{"type":["string","integer"]}}}}},"search_from":{"type":"integer","description":"An integer representing the starting offset within the query result set from which you want alerts returned.\r\nAlerts are returned as a zero-based list. Any alert indexed less than this value is not returned in the final result set and defaults to zero."},"search_to":{"type":"integer","description":"An integer representing the end offset within the result set after which you do not want alerts returned.\r\nAlerts in the alerts list that are indexed higher than this value are not returned in the final results set. Defaults to 100, which returns all alerts to the end of the list."},"sort":{"type":"object","description":"Identifies the sort order for the result set. By default the sort is defined as *creation_time*, *desc*.","required":["keyword"],"properties":{"field":{"enum":["severity","creation_time"],"description":"Identifies how to sort the result set, either according to severity or creation time. "},"keyword":{"enum":["asc","desc"],"description":"Defines whether to sort the results in ascending (asc) or descending (desc) order."}}}}}}}}},"description":"If no parameters are included, all results will be returned."},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"total_count":{"type":"integer","description":"Number of total results of this filter without paging. If filter returned 10,000 results or more than 9,999 will be the value and you can use paging to view the entire set of data."},"result_count":{"type":"integer","description":"Number of alerts actually returned as result."},"alerts":{"type":"array","items":{"$ref":"#/components/schemas/alert"}},"alert_id":{"type":"string"},"detection_timestamp":{"type":"integer"},"name":{"type":"string"},"category":{"type":"string"},"endpoint_id":{"type":"string"},"description":{"type":"string"},"host_ip":{"type":"array","items":{"type":"string"}},"host_name":{"type":"string"},"source":{"type":"string"},"action":{"type":"string"},"action_pretty":{"type":"string"},"malicious_urls":{"type":"array","description":"Malicious URL/s that have been detected in the destination or content of the accessed web page.","items":{"type":"string"}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"alert":{"title":"alert","type":"object","properties":{"external_id":{"type":"string"},"severity":{"type":"string"},"matching_status":{"type":"string"},"end_match_attempt_ts":{"type":"integer"},"local_insert_ts":{"type":"integer"},"bioc_indicator":{"type":"string"},"matching_service_rule_id":{"type":"string"},"attempt_counter":{"type":"integer"},"bioc_category_enum_key":{"type":"string"},"is_whitelisted":{"type":"boolean"},"starred":{"type":"boolean"},"deduplicate_tokens":{"type":"string"},"filter_rule_id":{"type":"string"},"mitre_technique_id_and_name":{"type":"array","items":{"type":"string"}},"mitre_tactic_id_and_name":{"type":"array","items":{"type":"string"}},"agent_version":{"type":"string"},"agent_device_domain":{"type":"string"},"agent_fqdn":{"type":"string"},"agent_os_type":{"type":"string"},"agent_os_sub_type":{"type":"string"},"agent_data_collection_status":{"type":"boolean"},"mac":{"type":"string"},"mac_address":{"type":"array","items":{"type":"string"}},"agent_is_vdi":{"type":"boolean"},"contains_featured_host":{"type":"string","enum":["YES","NO"]},"contains_featured_user":{"type":"string","enum":["YES","NO"]},"contains_featured_ip":{"type":"string","enum":["YES","NO"]},"events":{"type":"array","items":{"$ref":"#/components/schemas/event"}},"alert_id":{"type":"string"},"detection_timestamp":{"type":"integer"},"name":{"type":"string"},"category":{"type":"string"},"endpoint_id":{"type":"string"},"description":{"type":"string"},"host_ip":{"type":"array","items":{"type":"string"}},"host_name":{"type":"string"},"source":{"type":"string"},"action":{"type":"string"},"action_pretty":{"type":"string"}}},"event":{"title":"event","type":"object","properties":{"agent_install_type":{"type":"string"},"agent_host_boot_time":{"type":"integer"},"event_sub_type":{"type":"string"},"module_id":{"type":"string"},"association_strength":{"type":"string"},"dst_association_strength":{"type":"string"},"story_id":{"type":"string"},"event_id":{"type":"string"},"event_type":{"type":"string"},"event_timestamp":{"type":"integer"},"actor_process_instance_id":{"type":"string"},"actor_process_image_path":{"type":"string"},"actor_process_image_name":{"type":"string"},"actor_process_command_line":{"type":"string"},"actor_process_signature_status":{"type":"string"},"actor_process_signature_vendor":{"type":"string"},"actor_process_image_sha256":{"type":"string"},"actor_process_image_md5":{"type":"string"},"actor_process_causality_id":{"type":"string"},"actor_causality_id":{"type":"string"},"actor_process_os_pid":{"type":"string"},"actor_thread_thread_id":{"type":"string"},"causality_actor_process_image_name":{"type":"string"},"causality_actor_process_command_line":{"type":"string"},"causality_actor_process_image_path":{"type":"string"},"causality_actor_process_signature_vendor":{"type":"string"},"causality_actor_process_signature_status":{"type":"string"},"causality_actor_causality_id":{"type":"string"},"causality_actor_process_execution_time":{"type":"integer"},"causality_actor_process_image_md5":{"type":"string"},"causality_actor_process_image_sha256":{"type":"string"},"action_file_path":{"type":"string"},"action_file_name":{"type":"string"},"action_file_md5":{"type":"string"},"action_file_sha256":{"type":"string"},"action_file_macro_sha256":{"type":"string"},"action_registry_data":{"type":"string"},"action_registry_key_name":{"type":"string"},"action_registry_value_name":{"type":"string"},"action_registry_full_key":{"type":"string"},"action_local_ip":{"type":"string"},"action_local_port":{"type":"string"},"action_remote_ip":{"type":"string"},"action_remote_port":{"type":"string"},"action_external_hostname":{"type":"string"},"action_country":{"type":"string"},"action_process_instance_id":{"type":"string"},"action_process_causality_id":{"type":"string"},"action_process_image_name":{"type":"string"},"action_process_image_sha256":{"type":"string"},"action_process_image_command_line":{"type":"string"},"action_process_signature_status":{"type":"string"},"action_process_signature_vendor":{"type":"string"},"os_actor_effective_username":{"type":"string"},"os_actor_process_instance_id":{"type":"string"},"os_actor_process_image_path":{"type":"string"},"os_actor_process_image_name":{"type":"string"},"os_actor_process_command_line":{"type":"string"},"os_actor_process_signature_status":{"type":"string"},"os_actor_process_signature_vendor":{"type":"string"},"os_actor_process_image_sha256":{"type":"string"},"os_actor_process_causality_id":{"type":"string"},"os_actor_causality_id":{"type":"string"},"os_actor_process_os_pid":{"type":"string"},"os_actor_thread_thread_id":{"type":"string"},"fw_app_id":{"type":"string"},"fw_interface_from":{"type":"string"},"fw_interface_to":{"type":"string"},"fw_rule":{"type":"string"},"fw_rule_id":{"type":"string"},"fw_device_name":{"type":"string"},"fw_serial_number":{"type":"integer"},"fw_url_domain":{"type":"string"},"fw_email_subject":{"type":"string"},"fw_email_sender":{"type":"string"},"fw_email_recipient":{"type":"string"},"fw_app_subcategory":{"type":"string"},"fw_app_category":{"type":"string"},"fw_app_technology":{"type":"string"},"fw_vsys":{"type":"string"},"fw_xff":{"type":"string"},"fw_misc":{"type":"string"},"fw_is_phishing":{"type":"string"},"dst_agent_id":{"type":"string"},"dst_causality_actor_process_execution_time":{"type":"integer"},"dns_query_name":{"type":"string"},"dst_action_external_hostname":{"type":"string"},"dst_action_country":{"type":"string"},"dst_action_external_port":{"type":"string"},"user_name":{"type":"string"}}},"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Replace Featured Hosts

> Replace the featured hosts listed in your environment.\
> \
> Note: Running this API will delete all existing host names.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/featured_fields/replace_hosts":{"post":{"operationId":"postReplaceHosts","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Replace Featured Hosts","description":"Replace the featured hosts listed in your environment.\n\nNote: Running this API will delete all existing host names.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"fields":{"type":"array","description":"An array of host names and comments.","items":{"type":"object","properties":{"value":{"type":"string","description":"Defines the host name. Maximum length is 256 characters."},"comment":{"type":"string","description":"Represents additional information regarding the featured alert field."}},"required":["value"]}}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=host names successfully replaced"}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Replace Featured Users

> Replace the featured users listed in your environment.\
> \
> Note: Running this API will delete all existing user names.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/featured_fields/replace_users":{"post":{"operationId":"postReplaceUsers","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Replace Featured Users","description":"Replace the featured users listed in your environment.\n\nNote: Running this API will delete all existing user names.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"fields":{"type":"array","description":"An array of users and comments.","items":{"type":"object","properties":{"value":{"type":"string","description":"Defines the user name. Maximum length is 256 characters.","maxLength":256},"comment":{"type":"string","description":"Additional information regarding the featured alert field."}},"required":["value"]}}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true = User names successfully replaced."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Replace Featured IP Addresses

> Replace the featured IP addresses listed in your environment.\
> \
> Note: Running this API will delete all existing IP addresses.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/featured_fields/replace_ip_addresses":{"post":{"operationId":"postReplaceIpAddresses","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Replace Featured IP Addresses","description":"Replace the featured IP addresses listed in your environment.\n\nNote: Running this API will delete all existing IP addresses.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"fields":{"type":"array","description":"An array of IP addresses and comments.","items":{"type":"object","properties":{"value":{"type":"string","description":"Define the IP address. Maximum length is 256 characters, IP address can be a single IP address, range, or CIDR.","maxLength":256},"comment":{"type":"string","description":"String that represents additional information regarding the featured IP address."}},"required":["value"]}}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=IP addresses successfully replaced."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Replace Featured Active Directory Groups

> Replace the featured active directory groups and organizational units listed in your environment.\
> \
> Note: Running this API will delete all existing active directory groups.\
> \
> Required license: \*\*Cortex XDR Pro per Endpoint\*\* or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/featured_fields/replace_ad_groups":{"post":{"operationId":"postReplaceAdGroups","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"summary":"Replace Featured Active Directory Groups","description":"Replace the featured active directory groups and organizational units listed in your environment.\n\nNote: Running this API will delete all existing active directory groups.\n\nRequired license: **Cortex XDR Pro per Endpoint** or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"fields":{"type":"array","description":"An array of active directory groups and organizational units and comments.","items":{"type":"object","properties":{"value":{"type":"string","description":"String value that defines the active directory or organizational unit name. Maximum length is 256 characters.\nAn active directory name must be formated as: DOMAIN/GROUPNAME"},"type":{"type":"string","description":"Define whether you want to replace an active directory group or organizational unit.\nValid values are either `group` or `OU`.\nIf no value is defined, `group` is sent by default.","enum":["group","OU"],"default":"group"},"comment":{"type":"string","description":"String that represents additional information regarding the featured active directory group."}},"required":["value"]}}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=Active directory group successfully replaced."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Extra Incident Data

> Get extra data fields of a specific incident including alerts and key artifacts.\
> \
> Cortex XDR displays in the APIs response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the \*\*Retrieve PCAP Packet\*\* API to retrieve a list of alert IDs and their associated PCAP data.\
> \
> Note: The API includes a limit rate of 10 API requests per minute.\
> \
> Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\*

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Incident Management","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/incidents/get_incident_extra_data":{"post":{"summary":"Get Extra Incident Data","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Incident Management"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"incident":{"type":"object","properties":{"incident_id":{"type":"string"},"incident_name":{"type":"string"},"creation_time":{"type":"integer"},"modification_time":{"type":"integer"},"detection_time":{"nullable":true},"status":{"type":"string"},"severity":{"type":"string"},"description":{"type":"string"},"assigned_user_mail":{"type":"string"},"assigned_user_pretty_name":{"type":"string"},"alert_count":{"type":"integer"},"low_severity_alert_count":{"type":"integer"},"med_severity_alert_count":{"type":"integer"},"high_severity_alert_count":{"type":"integer"},"critical_severity_alert_count":{"type":"integer"},"user_count":{"type":"integer"},"host_count":{"type":"integer"},"notes":{"type":"string"},"resolve_comment":{"type":"string"},"manual_description":{"type":"string"},"xdr_url":{"type":"string"},"starred":{"type":"boolean"},"hosts":{"type":"array","items":{"type":"string"}},"users":{"type":"array","items":{"type":"object"}},"incident_sources":{"type":"array","items":{"type":"string"}},"rule_based_score":{"type":"integer"},"manual_score":{"nullable":true},"wildfire_hits":{"type":"integer"},"alerts_grouping_status":{"type":"string"},"mitre_techniques_ids_and_names":{"type":"array","items":{"type":"string"}},"mitre_tactics_ids_and_names":{"type":"array","items":{"type":"string"}},"alert_categories":{"type":"array","items":{"type":"string"}},"original_tags":{"type":"array","items":{"type":"string"}},"tags":{"type":"array","items":{"type":"string"}},"incident_domain":{"type":"string"},"custom_fields":{"type":"object"}}},"alerts":{"type":"object","properties":{"total_count":{"type":"integer"},"data":{"type":"array","items":{"type":"object","properties":{"external_id":{"type":"string"},"severity":{"type":"string"},"matching_status":{"type":"string"},"end_match_attempt_ts":{"nullable":true},"local_insert_ts":{"type":"integer"},"bioc_indicator":{"nullable":true},"matching_service_rule_id":{"nullable":true},"attempt_counter":{"nullable":true},"bioc_category_enum_key":{"nullable":true},"case_id":{"type":"integer"},"is_whitelisted":{"type":"boolean"},"starred":{"type":"boolean"},"deduplicate_tokens":{"type":"string"},"filter_rule_id":{"nullable":true},"mitre_technique_id_and_name":{"nullable":true},"mitre_tactic_id_and_name":{"nullable":true},"agent_version":{"nullable":true},"agent_device_domain":{"nullable":true},"agent_fqdn":{"nullable":true},"agent_os_type":{"type":"string"},"agent_os_sub_type":{"nullable":true},"agent_data_collection_status":{"nullable":true},"mac":{"nullable":true},"agent_is_vdi":{"nullable":true},"agent_install_type":{"type":"string"},"agent_host_boot_time":{"nullable":true},"event_sub_type":{"nullable":true},"module_id":{"nullable":true},"association_strength":{"nullable":true},"dst_association_strength":{"nullable":true},"story_id":{"nullable":true},"event_id":{"nullable":true},"event_type":{"type":"string"},"events_length":{"type":"integer"},"event_timestamp":{"nullable":true},"actor_process_instance_id":{"nullable":true},"actor_process_image_path":{"nullable":true},"actor_process_image_name":{"nullable":true},"actor_process_command_line":{"nullable":true},"actor_process_signature_status":{"type":"string"},"actor_process_signature_vendor":{"nullable":true},"actor_process_image_sha256":{"nullable":true},"actor_process_image_md5":{"nullable":true},"actor_process_causality_id":{"nullable":true},"actor_causality_id":{"nullable":true},"actor_process_os_pid":{"nullable":true},"actor_thread_thread_id":{"nullable":true},"causality_actor_process_image_name":{"nullable":true},"causality_actor_process_command_line":{"nullable":true},"causality_actor_process_image_path":{"nullable":true},"causality_actor_process_signature_vendor":{"nullable":true},"causality_actor_process_signature_status":{"type":"string"},"causality_actor_causality_id":{"nullable":true},"causality_actor_process_execution_time":{"nullable":true},"causality_actor_process_image_md5":{"nullable":true},"causality_actor_process_image_sha256":{"nullable":true},"action_file_path":{"nullable":true},"action_file_name":{"nullable":true},"action_file_md5":{"nullable":true},"action_file_sha256":{"nullable":true},"action_file_macro_sha256":{"nullable":true},"action_registry_data":{"nullable":true},"action_registry_key_name":{"nullable":true},"action_registry_value_name":{"nullable":true},"action_registry_full_key":{"nullable":true},"action_local_ip":{"type":"string"},"action_local_port":{"type":"string"},"action_remote_ip":{"type":"string"},"action_remote_port":{"type":"string"},"action_external_hostname":{"type":"string"},"action_country":{"type":"string"},"action_process_instance_id":{"nullable":true},"action_process_causality_id":{"nullable":true},"action_process_image_name":{"nullable":true},"action_process_image_sha256":{"nullable":true},"action_process_image_command_line":{"nullable":true},"action_process_signature_status":{"type":"string"},"action_process_signature_vendor":{"nullable":true},"os_actor_effective_username":{"nullable":true},"os_actor_process_instance_id":{"nullable":true},"os_actor_process_image_path":{"nullable":true},"os_actor_process_image_name":{"nullable":true},"os_actor_process_command_line":{"nullable":true},"os_actor_process_signature_status":{"type":"string"},"os_actor_process_signature_vendor":{"nullable":true},"os_actor_process_image_sha256":{"nullable":true},"os_actor_process_causality_id":{"nullable":true},"os_actor_causality_id":{"nullable":true},"os_actor_process_os_pid":{"nullable":true},"os_actor_thread_thread_id":{"nullable":true},"fw_app_id":{"nullable":true},"fw_interface_from":{"nullable":true},"fw_interface_to":{"nullable":true},"fw_rule":{"nullable":true},"fw_rule_id":{"nullable":true},"fw_device_name":{"nullable":true},"fw_serial_number":{"type":"string"},"fw_url_domain":{"nullable":true},"fw_email_subject":{"type":"string"},"fw_email_sender":{"nullable":true},"fw_email_recipient":{"nullable":true},"fw_app_subcategory":{"nullable":true},"fw_app_category":{"nullable":true},"fw_app_technology":{"nullable":true},"fw_vsys":{"nullable":true},"fw_xff":{"nullable":true},"fw_misc":{"nullable":true},"fw_is_phishing":{"type":"string"},"dst_agent_id":{"nullable":true},"dst_causality_actor_process_execution_time":{"nullable":true},"dns_query_name":{"nullable":true},"dst_action_external_hostname":{"nullable":true},"dst_action_country":{"nullable":true},"dst_action_external_port":{"nullable":true},"alert_id":{"type":"string"},"detection_timestamp":{"type":"integer"},"name":{"type":"string"},"category":{"type":"string"},"endpoint_id":{"nullable":true},"description":{"type":"string"},"host_ip":{"type":"string"},"host_name":{"type":"string"},"source":{"type":"string"},"action":{"type":"string"},"action_pretty":{"type":"string"},"user_name":{"nullable":true},"contains_featured_host":{"type":"string"},"contains_featured_user":{"type":"string"},"contains_featured_ip_address":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"device_product_id":{"type":"string","description":"Product ID of the device that generated the alert.","nullable":true},"device_serial_number":{"type":"string","description":"Serial number of the device that generated the alert.","nullable":true},"device_type":{"type":"string","description":"Type of the device that generated the alert.","nullable":true},"device_vendor_id":{"type":"string","description":"Vendor ID of the device that generated the alert.","nullable":true},"device_vendor_name":{"type":"string","description":"Name of the device vendor that generated the alert.","nullable":true},"original_tags":{"type":"string"}}}}}},"network_artifacts":{"type":"object","properties":{"total_count":{"type":"integer"},"data":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"alert_count":{"type":"integer"},"is_manual":{"type":"boolean"},"network_domain":{"type":"string"},"network_remote_ip":{"type":"string"},"network_remote_port":{"type":"string"},"network_country":{"type":"string"}}}}}},"file_artifacts":{"type":"object","properties":{"total_count":{"type":"integer"},"data":{"type":"array","items":{"type":"object","properties":{"alert_count":{"type":"integer"},"file_name":{"type":"string"},"File_sha256":{"type":"string"},"file_signature_status":{"type":"string"},"file_wildfire_verdict":{"type":"string"},"is_malicous":{"type":"boolean"},"is_manual":{"type":"boolean"},"is_process":{"type":"boolean"},"low_confidence":{"type":"boolean"},"type":{"type":"string"}}}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"404":{"description":"An error occurred while processing XDR public API - incident management - update_incident","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal Server Error"}},"operationId":"post-public_api-v1-incidents-get_incident_extra_data","description":"Get extra data fields of a specific incident including alerts and key artifacts.\n\nCortex XDR displays in the APIs response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the **Retrieve PCAP Packet** API to retrieve a list of alert IDs and their associated PCAP data.\n\nNote: The API includes a limit rate of 10 API requests per minute.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["incident_id"],"description":"A dictionary containing the API request fields.","properties":{"incident_id":{"type":"string","description":"The ID of the incident for which you want to retrieve extra data."},"alerts_limit":{"type":"integer","description":"The maximum number of related alerts in the incident that you want to retrieve.","default":1000}}}},"required":["request_data"]}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/incident-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.