Incident Management
APIs for managing incidents
Get a list of incidents filtered by a list of incident IDs, modification time, or creation time. This includes all incident types and severities, including correlation-generated incidents.
The response is concatenated using AND condition (OR is not supported).
The maximum result set size is >100.
Offset is the zero-based number of incidents from the start of the result set.
Note: You can send a request to retrieve either all or filtered results.
Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/incidents/get_incidents HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19
{
"request_data": {}
}{
"reply": {
"total_count": 1,
"result_count": 1,
"incidents": [
{
"incident_id": "<incident ID>",
"incident_name": "test",
"creation_time": 1577024425126,
"modification_time": 1577024425126,
"detection_time": null,
"status": "resolved_known_issue",
"severity": "medium",
"description": "Memory Corruption Exploit generated by XDR Agent",
"assigned_user_mail": null,
"assigned_user_pretty_name": null,
"alert_count": 1,
"low_severity_alert_count": 0,
"med_severity_alert_count": 1,
"high_severity_alert_count": 0,
"critical_severity_alert_count": 0,
"user_count": 1,
"host_count": 1,
"notes": null,
"resolve_comment": null,
"resolved_timestamp": 1577024425126,
"manual_severity": null,
"manual_description": "Memory Corruption Exploit generated by XDR Agent",
"xdr_url": "https://<link to incident>",
"starred": false,
"hosts": [
"<host ID>"
],
"users": [
"test_1",
"test_2"
],
"incident_sources": [
"XDR Agent",
"XDR BIOC"
],
"rule_based_score": 342,
"manual_score": null,
"wildfire_hits": 0,
"alerts_grouping_status": "Enabled",
"mitre_tactics_ids_and_names": [
"TA0004 - Privilege Escalation",
"TA0005 - Defense Evasion",
"TA0006 - Credential Access"
],
"mitre_techniques_ids_and_names": [
"T1001.001 - Data Obfuscation: Junk Data",
"T1001.002 - Data Obfuscation: Steganography",
"T1001.003 - Data Obfuscation: Protocol Impersonation"
],
"alert_categories": [
"Credential Access",
"Exploit",
"Spyware Detected via Anti-Spyware profile"
],
"original_tags": [
"DS:PANW/NGFW",
"EG:acme-2",
"EG:Acme group",
"DS:PANW/XDR Agent"
],
"tags": [
"EG:Acme group",
"DS:PANW/NGFW",
"DS:PANW/XDR Agent",
"EG:acme-2"
],
"starred_manually": true
}
],
"restricted_incident_ids": []
}
}Get a list of all or filtered alerts. The alerts listed are what remains after alert exclusions are applied by Cortex XDR.
Response is concatenated using AND condition (OR is not supported).
Maximum result set size is 100.
Offset is the zero-based number of alerts from the start of the result set. The response indicates whether an PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.
Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/alerts/get_alerts HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19
{
"request_data": {}
}{
"reply": {
"total_count": 20834,
"result_count": 1,
"alerts": [
{
"agent_os_sub_type": "6.3.9600",
"fw_app_category": null,
"fw_app_id": null,
"fw_app_subcategory": null,
"fw_app_technology": null,
"causality_actor_process_command_line": null,
"causality_actor_process_image_md5": null,
"causality_actor_process_image_name": null,
"causality_actor_process_image_path": null,
"causality_actor_process_image_sha256": null,
"causality_actor_process_signature_status": "N/A",
"causality_actor_process_signature_vendor": null,
"causality_actor_causality_id": null,
"identity_sub_type": null,
"identity_type": null,
"operation_name": null,
"project": null,
"cloud_provider": null,
"referenced_resource": null,
"resource_sub_type": null,
"resource_type": null,
"cluster_name": null,
"container_id": null,
"contains_featured_host": "NO",
"contains_featured_ip": "NO",
"contains_featured_user": "NO",
"action_country": "UNKNOWN",
"fw_interface_to": null,
"dns_query_name": null,
"agent_device_domain": "attractions.disney.com",
"fw_email_recipient": null,
"fw_email_sender": null,
"fw_email_subject": null,
"event_type": null,
"is_whitelisted": false,
"action_file_macro_sha256": null,
"action_file_md5": null,
"action_file_name": null,
"action_file_path": null,
"action_file_sha256": null,
"fw_device_name": null,
"fw_rule_id": null,
"fw_rule": null,
"fw_serial_number": null,
"agent_fqdn": "FL-ATR-DC3-04.attractions.disney.com",
"mac": "00:50:56:bb:34:34,00:50:56:bc:bc:2f",
"agent_os_type": "Windows",
"image_name": null,
"actor_process_image_name": "10.91.72.115",
"actor_process_command_line": null,
"actor_process_image_md5": null,
"actor_process_image_path": null,
"actor_process_os_pid": null,
"actor_process_image_sha256": null,
"actor_process_signature_status": "N/A",
"actor_process_signature_vendor": null,
"actor_thread_thread_id": null,
"fw_is_phishing": "N/A",
"action_local_ip": null,
"action_local_port": null,
"fw_misc": null,
"mitre_tactic_id_and_name": "TA0007 - Discovery",
"mitre_technique_id_and_name": "T1012 - Query Registry",
"module_id": "Behavioral Threat Protection",
"fw_vsys": null,
"os_actor_process_command_line": null,
"os_actor_thread_thread_id": null,
"os_actor_process_image_name": null,
"os_actor_process_os_pid": null,
"os_actor_process_image_sha256": null,
"os_actor_process_signature_status": "N/A",
"os_actor_process_signature_vendor": null,
"os_actor_effective_username": null,
"action_process_signature_status": "N/A",
"action_process_signature_vendor": null,
"action_registry_data": null,
"action_registry_full_key": null,
"action_external_hostname": null,
"action_remote_ip": "10.71.62.215",
"action_remote_port": null,
"matching_service_rule_id": null,
"fw_interface_from": null,
"starred": false,
"action_process_image_command_line": null,
"action_process_image_name": null,
"action_process_image_sha256": null,
"fw_url_domain": null,
"user_agent": null,
"fw_xff": null,
"alert_domain": "DOMAIN_SECURITY",
"external_id": "7c96737d50f74c7b9487450426e9eafb",
"severity": "high",
"matching_status": "MATCHED",
"end_match_attempt_ts": null,
"local_insert_ts": 1706539597503,
"last_modified_ts": 1706539706370,
"bioc_indicator": null,
"attempt_counter": 0,
"bioc_category_enum_key": null,
"case_id": 391722,
"deduplicate_tokens": null,
"filter_rule_id": null,
"agent_version": "8.1.0.42616",
"agent_ip_addresses_v6": null,
"agent_data_collection_status": false,
"agent_is_vdi": false,
"agent_install_type": "STANDARD",
"agent_host_boot_time": null,
"event_sub_type": null,
"association_strength": 50,
"dst_association_strength": null,
"story_id": null,
"event_id": null,
"event_timestamp": 1706540499609,
"actor_process_instance_id": null,
"actor_process_causality_id": null,
"actor_causality_id": null,
"causality_actor_process_execution_time": null,
"action_registry_key_name": null,
"action_registry_value_name": null,
"action_local_ip_v6": null,
"action_remote_ip_v6": null,
"action_process_instance_id": null,
"action_process_causality_id": null,
"os_actor_process_instance_id": null,
"os_actor_process_image_path": null,
"os_actor_process_causality_id": null,
"os_actor_causality_id": null,
"dst_agent_id": null,
"dst_causality_actor_process_execution_time": null,
"dst_action_external_hostname": null,
"dst_action_country": null,
"dst_action_external_port": null,
"is_pcap": false,
"image_id": null,
"container_name": null,
"namespace": null,
"alert_type": "Unclassified",
"resolution_status": "STATUS_020_UNDER_INVESTIGATION",
"resolution_comment": null,
"dynamic_fields": null,
"tags": "DS:PANW/XDR Agent",
"malicious_urls": null,
"dss_job_title": null,
"dss_department": null,
"dss_country": null,
"dss_groups": null,
"alert_id": "50023290705",
"detection_timestamp": 1706540499609,
"name": "Behavioral Threat",
"category": "Malware",
"endpoint_id": "866d9341c27a4df389b246d977d216ec",
"description": "Behavioral threat detected (rule: sync.query_ntdsdit_vssadmin_remote)",
"host_ip": "10.71.62.2,10.71.62.5",
"host_name": "hostname",
"source": "XDR Agent",
"action": "REPORTED",
"action_pretty": "Detected (Reported)",
"user_name": null,
"events_length": 1,
"original_tags": "DS:PANW/XDR Agent"
}
]
}
}Update one or more fields of a specific incident. Missing fields are ignored. Note the following:
assigned_user_mailfield is validated by Cortex XDR to confirm the provided assignee email address belongs to a user that exists in the same Cortex XDR tenant.To unassign an incident pass
noneor”assigned_user_mail”: “”.To remove a manually set severity pass
noneor“manual_severity”: “”.
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
Whether the incident update was successful.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors. For example, test@test.com is not a valid Cortex XDR email address.
POST /public_api/v1/incidents/update_incident HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 192
{
"request_data": {
"incident_id": "2927",
"update_data": {
"assigned_user_mail": "username@test.com",
"manual_severity": "low",
"status": "resolved_other",
"resolve_comment": "This incident is resolved"
}
}
}trueUpdate one or more alerts. You can update up to 100 alerts per request. Missing fields are ignored.
Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
IDs of alerts that were updated.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors. For example, test@test.com is not a valid Cortex XDR email address.
POST /public_api/v1/alerts/update_alerts HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 152
{
"request_data": {
"alert_id_list": [
"<list of alert IDs>"
],
"update_data": {
"severity": "low",
"status": "resolved_other",
"comment": "This alert is resolved"
}
}
}{
"reply": {
"alerts_ids": [
104173820,
574203823,
395720183
]
}
}Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views. You can send 600 alerts per minute.
Required license: Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
true=upload successful
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/alerts/insert_cef_alerts HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 1130
{
"request_data": {
"alerts": [
"CEF:0|Check Point|VPN-1 & FireWall-1|Check Point|Log|microsoft-ds|Unknown|act=AcceptdeviceDirection=0 rt=1569---000 spt=5---57 dpt=4---5cs2Label=Rule Name cs2=ADPrimery layer_name=FW_Device_blackenedSecuritylayer_uuid=07-----fc7-1a5c-71b8c match_id=1---6parent_rule=0rule_action=Accept rule_uid=8----be5cifname=bond2logid=0 loguid={0x5d8c5388,0x61,0x29321fac,0xc0000022}origin=1.1.1.1originsicname=CN=DWdeviceBlackend,O=Blackend sequencenum=363version=5dst=1.1.1.1 inzone=External outzone=Internal product=VPN-1 & FireWall-1 proto=6service_id=microsoft-ds src=1.1.1.1",
"CEF:0|Check Point|VPN-1 & FireWall-1|Check Point|Log|Log|Unknown|act=AcceptdeviceDirection=0 rt=1569477501000 spt=63088 dpt=5985cs2Label=Rule Namelayer_name=FW_Device_blackenedSecuritylayer_uuid=07693f---e96c71b8c match_id=8----9parent_rule=0rule_action=Acceptrule_uid=ae9---70f-ab1c-1ad552c82369conn_direction=Internal ifname=bond1.12logid=0loguid=0x5d8c537d,0xbb,0x29321fac,0xc0000014}origin=1.1.1.1originsicname=CN=DWdeviceBlackend,O=Blackend sequencenum=899version=5dst=1.1.1.1 product=VPN-1 & FireWall-1 proto=6 src=1.1.1.1"
]
}
}trueUpload alerts from external alert sources in Cortex XDR format. Cortex XDRdisplays alerts that are parsed successfully in related incidents and views. You can send 600 alerts per minute. Each request can contain a maximum of 60 alerts.
Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
true=upload successful
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/alerts/insert_parsed_alerts HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 396
{
"request_data": {
"alerts": [
{
"product": "VPN & Firewall-1",
"vendor": "<vendor name>",
"local_ip": "<IP address>",
"local_port": "<port>",
"remote_ip": "<IP address>",
"remote_port": "<port>",
"event_timestamp": 1543270652000,
"severity": "Low",
"alert_name": "Alert Name Example",
"alert_description": "Alert Description",
"action_status": "Reported",
"local_ip_v6": "<IPv6 address>",
"remote_ip_v6": "<IPv6 address>"
}
]
}
}trueRetrieve a list of alert IDs and the associated PCAP triggering packets of PAN NGFW type alerts returned when running the Get Alerts and Get Extra Incident Data APIs. Maximum result set size is 100.
Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/alerts/get_alerts_pcap HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19
{
"request_data": {}
}{
"reply": [
{
"id": 283839,
"pcap_data": ""
},
{
"id": 319541,
"pcap_data": "<pcap_data>"
}
]
}Get a list of alerts with multiple events.
The response is concatenated using AND condition (OR is not supported).
The maximum result set size is 100.
Offset is the zero-based number of alerts from the start of the result set.
Cortex XDR displays in the API response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.
Note: You can send a request to retrieve either all or filtered results.
Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipOK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v2/alerts/get_alerts_multi_events HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 93
{
"request_data": {
"filters": [
{
"field": "severity",
"operator": "in",
"value": [
"medium",
"high"
]
}
]
}
}{
"reply": {
"total_count": 1,
"result_count": 1,
"alerts": [
{
"agent_os_sub_type": "text",
"fw_app_category": null,
"fw_app_id": null,
"fw_app_subcategory": null,
"fw_app_technology": null,
"category": "text",
"causality_actor_process_command_line": [
"text"
],
"causality_actor_process_image_md5": [
"text"
],
"causality_actor_process_image_name": [
"text"
],
"causality_actor_process_image_path": [
"text"
],
"causality_actor_process_image_sha256": [
"text"
],
"causality_actor_process_signature_status": [
"text"
],
"causality_actor_process_signature_vendor": [
"text"
],
"causality_actor_causality_id": [
"text"
],
"identity_sub_type": null,
"identity_type": null,
"operation_name": null,
"project": null,
"cloud_provider": null,
"referenced_resource": null,
"resource_sub_type": null,
"resource_type": null,
"cluster_name": null,
"container_id": null,
"contains_featured_host": [
"text"
],
"contains_featured_ip": [
"text"
],
"contains_featured_user": [
"text"
],
"action_country": [
"text"
],
"description": "text",
"fw_interface_to": null,
"dns_query_name": null,
"agent_device_domain": null,
"fw_email_recipient": null,
"fw_email_sender": null,
"fw_email_subject": null,
"event_type": [
"text"
],
"is_whitelisted": true,
"action_file_macro_sha256": null,
"action_file_md5": null,
"action_file_name": null,
"action_file_path": null,
"action_file_sha256": null,
"fw_device_name": null,
"fw_rule_id": null,
"fw_rule": null,
"fw_serial_number": null,
"agent_fqdn": null,
"agent_os_type": "text",
"image_name": null,
"actor_process_image_name": [
"text"
],
"actor_process_command_line": [
"text"
],
"actor_process_image_md5": [
"text"
],
"actor_process_image_path": [
"text"
],
"actor_process_os_pid": [
1
],
"actor_process_image_sha256": [
"text"
],
"actor_process_signature_status": [
"text"
],
"actor_process_signature_vendor": [
"text"
],
"actor_thread_thread_id": [
1
],
"fw_is_phishing": [
"text"
],
"action_local_ip": null,
"action_local_port": null,
"fw_misc": null,
"mitre_tactic_id_and_name": [
"text"
],
"mitre_technique_id_and_name": [
"text"
],
"module_id": null,
"fw_vsys": null,
"os_actor_process_command_line": [
"text"
],
"os_actor_thread_thread_id": [
1
],
"os_actor_process_image_name": [
"text"
],
"os_actor_process_os_pid": [
1
],
"os_actor_process_image_sha256": [
"text"
],
"os_actor_process_signature_status": [
"text"
],
"os_actor_process_signature_vendor": [
"text"
],
"os_actor_effective_username": null,
"action_process_signature_status": [
"text"
],
"action_process_signature_vendor": null,
"action_registry_data": null,
"action_registry_full_key": null,
"action_external_hostname": null,
"action_remote_ip": null,
"action_remote_port": null,
"matching_service_rule_id": "text",
"fw_interface_from": null,
"starred": true,
"action_process_image_command_line": null,
"action_process_image_name": null,
"action_process_image_sha256": null,
"fw_url_domain": null,
"user_agent": null,
"fw_xff": null,
"external_id": "text",
"severity": "text",
"matching_status": "text",
"end_match_attempt_ts": null,
"local_insert_ts": 1,
"last_modified_ts": null,
"bioc_indicator": null,
"attempt_counter": 1,
"bioc_category_enum_key": null,
"case_id": 1,
"deduplicate_tokens": null,
"filter_rule_id": null,
"agent_version": "text",
"agent_ip_addresses_v6": null,
"agent_data_collection_status": null,
"agent_is_vdi": true,
"agent_install_type": "text",
"agent_host_boot_time": [
1
],
"event_sub_type": [
1
],
"association_strength": [
1
],
"dst_association_strength": null,
"story_id": null,
"event_id": [
"text"
],
"event_timestamp": [
1
],
"actor_process_instance_id": [
"text"
],
"actor_process_causality_id": [
"text"
],
"actor_causality_id": [
"text"
],
"causality_actor_process_execution_time": [
1
],
"action_registry_key_name": null,
"action_registry_value_name": null,
"action_local_ip_v6": null,
"action_remote_ip_v6": null,
"action_process_instance_id": null,
"action_process_causality_id": null,
"os_actor_process_instance_id": [
"text"
],
"os_actor_process_image_path": [
"text"
],
"os_actor_process_causality_id": [
"text"
],
"os_actor_causality_id": null,
"dst_agent_id": [
"text"
],
"dst_causality_actor_process_execution_time": null,
"dst_action_external_hostname": null,
"dst_action_country": null,
"dst_action_external_port": null,
"is_pcap": true,
"alert_type": "text",
"resolution_status": "text",
"resolution_comment": null,
"dynamic_fields": null,
"tags": [
"text"
],
"alert_id": "text",
"detection_timestamp": 1,
"name": "text",
"endpoint_id": "text",
"host_ip": [
"text"
],
"host_name": "text",
"action": "text",
"original_tags": [
"text"
],
"user_name": [
"text"
],
"mac_addresses": null,
"source": null,
"action_pretty": "text",
"variation_rule_id": "text"
}
]
}
}**Note: ** This endpoint is legacy. Use the Get Alerts Multi-Events v2 endpoint.
Get a list of alerts with multiple events.
Response is concatenated using AND condition (OR is not supported).
Maximum result set size is 100.
Offset is the zero-based number of alerts from the start of the result set. Cortex XDR displays in the APIs response whether an PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.
Note: You can send a request to retrieve either all or filtered results.
Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
Number of total results of this filter without paging. If filter returned 10,000 results or more than 9,999 will be the value and you can use paging to view the entire set of data.
Number of alerts actually returned as result.
Malicious URL/s that have been detected in the destination or content of the accessed web page.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/alerts/get_alerts_multi_events HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19
{
"request_data": {}
}{
"reply": {
"total_count": 45,
"result_count": 1,
"alerts": [
{
"external_id": "<external ID>",
"severity": "high",
"matching_status": "FAILED",
"end_match_attempt_ts": 1603552062824,
"local_insert_ts": 1603279967500,
"bioc_indicator": null,
"matching_service_rule_id": null,
"attempt_counter": 55,
"bioc_category_enum_key": null,
"is_whitelisted": false,
"starred": false,
"deduplicate_tokens": null,
"filter_rule_id": null,
"mitre_technique_id_and_name": [
""
],
"mitre_tactic_id_and_name": [
""
],
"agent_version": "<agent version>",
"agent_device_domain": null,
"agent_fqdn": "test",
"agent_os_type": "Windows",
"agent_os_sub_type": "<os subtype>",
"agent_data_collection_status": true,
"mac": null,
"mac_address": [
"<mac address>"
],
"agent_is_vdi": null,
"contains_featured_host": false,
"contains_featured_user": false,
"contains_featured_ip": false,
"events": [
{
"agent_install_type": "NA",
"agent_host_boot_time": null,
"event_sub_type": null,
"module_id": "Privilege Escalation Protection",
"association_strength": null,
"dst_association_strength": null,
"story_id": null,
"event_id": null,
"event_type": "Process Execution",
"event_timestamp": 1603279888980,
"actor_process_instance_id": "<instance ID>",
"actor_process_image_path": "c:\\<file path>\\virus.exe",
"actor_process_image_name": "virus.exe",
"actor_process_command_line": "c:\\<file path>\\virus.exe",
"actor_process_signature_status": "N/A",
"actor_process_signature_vendor": null,
"actor_process_image_sha256": "<SHA256 value>",
"actor_process_image_md5": null,
"actor_process_causality_id": null,
"actor_causality_id": null,
"actor_process_os_pid": "<PID>",
"actor_thread_thread_id": null,
"causality_actor_process_image_name": null,
"causality_actor_process_command_line": null,
"causality_actor_process_image_path": null,
"causality_actor_process_signature_vendor": null,
"causality_actor_process_signature_status": "N/A",
"causality_actor_causality_id": null,
"causality_actor_process_execution_time": null,
"causality_actor_process_image_md5": null,
"causality_actor_process_image_sha256": null,
"action_file_path": null,
"action_file_name": null,
"action_file_md5": null,
"action_file_sha256": null,
"action_file_macro_sha256": null,
"action_registry_data": null,
"action_registry_key_name": null,
"action_registry_value_name": null,
"action_registry_full_key": null,
"action_local_ip": null,
"action_local_port": null,
"action_remote_ip": null,
"action_remote_port": null,
"action_external_hostname": null,
"action_country": "UNKNOWN",
"action_process_instance_id": null,
"action_process_causality_id": null,
"action_process_image_name": null,
"action_process_image_sha256": null,
"action_process_image_command_line": null,
"action_process_signature_status": "N/A",
"action_process_signature_vendor": null,
"os_actor_effective_username": null,
"os_actor_process_instance_id": null,
"os_actor_process_image_path": null,
"os_actor_process_image_name": null,
"os_actor_process_command_line": null,
"os_actor_process_signature_status": "N/A",
"os_actor_process_signature_vendor": null,
"os_actor_process_image_sha256": null,
"os_actor_process_causality_id": null,
"os_actor_causality_id": null,
"os_actor_process_os_pid": null,
"os_actor_thread_thread_id": null,
"fw_app_id": null,
"fw_interface_from": null,
"fw_interface_to": null,
"fw_rule": null,
"fw_rule_id": null,
"fw_device_name": null,
"fw_serial_number": null,
"fw_url_domain": null,
"fw_email_subject": null,
"fw_email_sender": null,
"fw_email_recipient": null,
"fw_app_subcategory": null,
"fw_app_category": null,
"fw_app_technology": null,
"fw_vsys": null,
"fw_xff": null,
"fw_misc": null,
"fw_is_phishing": "N/A",
"dst_agent_id": null,
"dst_causality_actor_process_execution_time": null,
"dns_query_name": null,
"dst_action_external_hostname": null,
"dst_action_country": null,
"dst_action_external_port": null,
"user_name": null
}
],
"alert_id": "<alert ID>",
"detection_timestamp": 1603279888980,
"name": "Kernel Privilege Escalation",
"category": "Exploit",
"endpoint_id": "<endpoint ID>",
"description": "Local privilege escalation prevented",
"host_ip": [
"<IP address>"
],
"host_name": "Test",
"source": "XDR Agent",
"action": "BLOCKED",
"action_pretty": "Prevented (Blocked)"
}
]
}
}Replace the featured hosts listed in your environment.
Note: Running this API will delete all existing host names.
Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
true=host names successfully replaced
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/featured_fields/replace_hosts HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 109
{
"request_data": {
"fields": [
{
"value": "ADMIN-PC",
"comment": "ADMIN-PC is a featured host"
},
{
"value": "CEO-PC"
}
]
}
}trueReplace the featured users listed in your environment.
Note: Running this API will delete all existing user names.
Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
true = User names successfully replaced.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/featured_fields/replace_users HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 119
{
"request_data": {
"fields": [
{
"value": "Administrator",
"comment": "Administrator is a featured user"
},
{
"value": "System"
}
]
}
}trueReplace the featured IP addresses listed in your environment.
Note: Running this API will delete all existing IP addresses.
Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
true=IP addresses successfully replaced.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/featured_fields/replace_ip_addresses HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 199
{
"request_data": {
"fields": [
{
"value": "1.2.3.4",
"comment": "A single featured IP"
},
{
"value": "192.111.1.0-192.111.1.255",
"comment": "Featured IP range"
},
{
"value": "7.7.7.7/16",
"comment": "Featured CIDR"
}
]
}
}trueReplace the featured active directory groups and organizational units listed in your environment.
Note: Running this API will delete all existing active directory groups.
Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipSuccessful response
true=Active directory group successfully replaced.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/featured_fields/replace_ad_groups HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 168
{
"request_data": {
"fields": [
{
"value": "domain/administrators-group",
"type": "group",
"comment": "Administrators-group is a featured AD group"
},
{
"value": "dev",
"type": "OU"
}
]
}
}trueGet extra data fields of a specific incident including alerts and key artifacts.
Cortex XDR displays in the APIs response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.
Note: The API includes a limit rate of 10 API requests per minute.
Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB
{api_key}
{api_key_id}
For retrieving a compressed gzipped response
gzipOK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
An error occurred while processing XDR public API - incident management - update_incident
Internal Server Error
POST /public_api/v1/incidents/get_incident_extra_data HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 65
{
"request_data": {
"incident_id": "<incident ID>",
"alerts_limit": 5
}
}{
"reply": {
"incident": {
"incident_id": "<incient ID>",
"incident_name": "test",
"creation_time": 1603184209710,
"modification_time": 1603184209710,
"detection_time": null,
"status": "new",
"severity": "high",
"description": "generated by PAN NGFW",
"assigned_user_mail": null,
"assigned_user_pretty_name": null,
"alert_count": 1,
"low_severity_alert_count": 0,
"med_severity_alert_count": 0,
"high_severity_alert_count": 1,
"critical_severity_alert_count": 0,
"user_count": 0,
"host_count": 0,
"notes": null,
"resolve_comment": null,
"manual_severity": null,
"manual_description": null,
"xdr_url": "https://test.xdr.us.paloaltonetworks.com/incident-view/1",
"starred": false,
"hosts": [
"<host1>:<agent_id1>",
"<host2>:<agent_id2>"
],
"users": [],
"incident_sources": [
"PAN NGFW"
],
"rule_based_score": 342,
"manual_score": null,
"wildfire_hits": 0,
"alerts_grouping_status": "Enabled",
"mitre_techniques_ids_and_names": [
"TA0004 - Privilege Escalation",
"TA0005 - Defense Evasion",
"TA0006 - Credential Access"
],
"mitre_tactics_ids_and_names": [
"T1001.001 - Data Obfuscation: Junk Data",
"T1001.002 - Data Obfuscation: Steganography",
"T1001.003 - Data Obfuscation: Protocol Impersonation"
],
"alert_categories": [
"Collection",
"Credential Access",
"File Name"
]
},
"alerts": {
"total_count": 1,
"data": [
{
"external_id": "<external ID>",
"severity": "high",
"matching_status": "UNMATCHABLE",
"end_match_attempt_ts": null,
"local_insert_ts": 1603175431,
"bioc_indicator": null,
"matching_service_rule_id": null,
"attempt_counter": null,
"bioc_category_enum_key": null,
"case_id": 1,
"is_whitelisted": false,
"starred": false,
"deduplicate_tokens": "<token value>",
"filter_rule_id": null,
"mitre_technique_id_and_name": null,
"mitre_tactic_id_and_name": null,
"agent_version": null,
"agent_device_domain": null,
"agent_fqdn": null,
"agent_os_type": "NO_HOST",
"agent_os_sub_type": null,
"agent_data_collection_status": null,
"mac": null,
"agent_is_vdi": null,
"agent_install_type": "NA",
"agent_host_boot_time": null,
"event_sub_type": null,
"module_id": null,
"association_strength": null,
"dst_association_strength": null,
"story_id": null,
"event_id": null,
"event_type": "Network Event",
"events_length": 1,
"event_timestamp": null,
"actor_process_instance_id": null,
"actor_process_image_path": null,
"actor_process_image_name": null,
"actor_process_command_line": null,
"actor_process_signature_status": "N/A",
"actor_process_signature_vendor": null,
"actor_process_image_sha256": null,
"actor_process_image_md5": null,
"actor_process_causality_id": null,
"actor_causality_id": null,
"actor_process_os_pid": null,
"actor_thread_thread_id": null,
"causality_actor_process_image_name": null,
"causality_actor_process_command_line": null,
"causality_actor_process_image_path": null,
"causality_actor_process_signature_vendor": null,
"causality_actor_process_signature_status": "N/A",
"causality_actor_causality_id": null,
"causality_actor_process_execution_time": null,
"causality_actor_process_image_md5": null,
"causality_actor_process_image_sha256": null,
"action_file_path": null,
"action_file_name": null,
"action_file_md5": null,
"action_file_sha256": null,
"action_file_macro_sha256": null,
"action_registry_data": null,
"action_registry_key_name": null,
"action_registry_value_name": null,
"action_registry_full_key": null,
"action_local_ip": "<IP address>",
"action_local_port": "<port>",
"action_remote_ip": "<IP address>",
"action_remote_port": "<port>",
"action_external_hostname": "<hostname>",
"action_country": "UNKNOWN",
"action_process_instance_id": null,
"action_process_causality_id": null,
"action_process_image_name": null,
"action_process_image_sha256": null,
"action_process_image_command_line": null,
"action_process_signature_status": "N/A",
"action_process_signature_vendor": null,
"os_actor_effective_username": null,
"os_actor_process_instance_id": null,
"os_actor_process_image_path": null,
"os_actor_process_image_name": null,
"os_actor_process_command_line": null,
"os_actor_process_signature_status": "N/A",
"os_actor_process_signature_vendor": null,
"os_actor_process_image_sha256": null,
"os_actor_process_causality_id": null,
"os_actor_causality_id": null,
"os_actor_process_os_pid": null,
"os_actor_thread_thread_id": null,
"fw_app_id": null,
"fw_interface_from": null,
"fw_interface_to": null,
"fw_rule": null,
"fw_rule_id": null,
"fw_device_name": null,
"fw_serial_number": "<serial number>",
"fw_url_domain": null,
"fw_email_subject": "",
"fw_email_sender": null,
"fw_email_recipient": null,
"fw_app_subcategory": null,
"fw_app_category": null,
"fw_app_technology": null,
"fw_vsys": null,
"fw_xff": null,
"fw_misc": null,
"fw_is_phishing": "N/A",
"dst_agent_id": null,
"dst_causality_actor_process_execution_time": null,
"dns_query_name": null,
"dst_action_external_hostname": null,
"dst_action_country": null,
"dst_action_external_port": null,
"alert_id": "1",
"detection_timestamp": 1603184109000,
"name": "sagcalun",
"category": "Spyware Detected via Anti-Spyware profile",
"endpoint_id": null,
"description": "Spyware Phone Home Detection",
"host_ip": "<IP address>",
"host_name": "<hostname>",
"source": "PAN NGFW",
"action": "DETECTED_4",
"action_pretty": "Detected (Raised An Alert)",
"user_name": null,
"device_product_id": null,
"device_serial_number": null,
"device_type": null,
"device_vendor_id": null,
"device_vendor_name": null,
"contains_featured_host": "Yes",
"contains_featured_user": "Yes",
"contains_featured_ip_address": "Yes",
"tags": [
"XDR Agent",
"EG:Windows"
],
"original_tags": "None"
}
]
},
"network_artifacts": {
"total_count": 2,
"data": [
{
"type": "DOMAIN",
"alert_count": 1,
"is_manual": false,
"network_domain": "<domain name>",
"network_remote_ip": "<IP address>",
"network_remote_port": "<port>",
"network_country": "UNKNOWN"
},
{
"type": "IP",
"alert_count": 1,
"is_manual": false,
"network_domain": "<domain name>",
"network_remote_ip": "<IP address>",
"network_remote_port": "<port>",
"network_country": "UNKNOWN"
}
]
},
"file_artifacts": {
"total_count": 2,
"data": [
{
"alert_count": 2,
"file_name": "Test",
"File_sha256": "1111",
"file_signature_status": "SIGNATURE_UNAVAILABLE",
"file_wildfire_verdict": "BENIGN",
"is_malicous": false,
"is_manual": false,
"is_process": false,
"low_confidence": true,
"type": "HASH"
},
{
"alert_count": 43,
"file_name": "Test1",
"File_sha256": "2222",
"file_signature_status": "SIGNATURE_UNAVAILABLE",
"file_wildfire_verdict": "MALWARE",
"is_malicous": true,
"is_manual": false,
"is_process": false,
"low_confidence": true,
"type": "HASH"
}
]
}
}
}Last updated
Was this helpful?