> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/issues-apis/models.md).

# Models

## The Issue object

```json
{"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"Issue":{"type":"object","description":"Issue object returned by the search endpoint. Fields correspond to the PUBLIC_FIELDS_GET_ISSUE list in the codebase.","properties":{"_insert_time":{"type":"integer","format":"int64","description":"Issue creation timestamp in epoch milliseconds.","nullable":true},"external_id":{"type":"string"},"name":{"type":"string"},"description":{"type":"string"},"observation_time":{"type":"integer","format":"int64"},"domain":{"type":"string","description":"Issue domain. Default domains listed below; custom domains may also be configured per tenant.","enum":["Security","Health","Hunting","IT","Posture"]},"detection.method":{"type":"string","description":"Detection source or method that created the issue.","enum":["TRAPS","MAGNIFIER","ANALYTICS_BIOC","FW","BIOC","IOC","THREAT_INTELLIGENCE","MTH","CORRELATION","PRISMA_CLOUD","PRISMA_CLOUD_COMPUTE","XPANSE","IOT","CREATE_ALERT_PUBLIC_API","HEALTH","EMAIL_ATTACHMENT","ATTACK_PATH","POSTURE_POLICY","CAS_DRIFT_SCANNER","CLOUD_NETWORK_ANALYZER","CAS_IAC_SCANNER","CAS_SECRET_SCANNER","CAS_CI_CD_RISK_SCANNER","CLI_SCANNER","CIEM_SCANNER","API_TRAFFIC_MONITOR","API_POSTURE_SCANNER","AGENTLESS_DISK_SCANNER","KUBERNETES_SCANNER","COMPUTE_POLICY","CSPM_SCANNER","CAS_CVE_SCANNER","CAS_LICENSE_SCANNER","SECRETS_SCANNER","CAS_SAST_SCANNER","DATA_POLICY","CAS_OPERATIONAL_RISK_SCANNER","VULNERABILITY_POLICY","AISPM_RULE_ENGINE","DLP","MIRRORING","AURL","USER_REPORTED_PHISHING","GRAPH_ENGINE"]},"detection.rule_id":{"type":"string"},"category":{"type":"string","description":"Issue category classification.","enum":["CONFIGURATION","VULNERABILITY","MALWARE","IDENTITY","NETWORK","DATA_LOSS","COMPLIANCE","RUNTIME","SECRETS","IAC","CI_CD_RISKS","DRIFT","API_SECURITY","POSTURE","COMPUTE","LICENSE","OPERATIONAL_RISK","AI_SECURITY"]},"findings":{"type":"array","items":{"type":"string"}},"asset_ids":{"type":"array","items":{"type":"string"}},"asset_names":{"type":"array","items":{"type":"string"}},"asset_group_ids":{"type":"array","items":{"type":"integer"}},"asset_classes":{"type":"array","items":{"type":"string","enum":["Compute","Data","Network","Identity","Security","Management","Application","IoT","Other"]}},"asset_categories":{"type":"array","items":{"type":"string","enum":["Storage Bucket","Virtual Machine","Database Instance","Container","Serverless Function","Load Balancer","Firewall","VPN Gateway","IAM Role","IAM User","IAM Group","IAM Policy","Service Account","Kubernetes Cluster","Kubernetes Pod","Kubernetes Node","Network Interface","Subnet","VPC","Security Group","DNS Zone","Certificate","Key Vault","Disk","Snapshot","Image","Queue","Topic","API Gateway","CDN","Other"]}},"asset_regions":{"type":"array","items":{"type":"string"},"description":"Cloud regions where the assets are located. Values depend on the cloud provider (e.g., AWS: us-east-1, Azure: eastus, GCP: us-central1)."},"asset_providers":{"type":"array","items":{"type":"string","enum":["AWS","Azure","GCP","Oracle Cloud","IBM Cloud","Alibaba Cloud","Other"]}},"asset_accounts":{"type":"array","items":{"type":"string"}},"asset_types":{"type":"array","items":{"type":"string"}},"mitre_tactics":{"type":"array","items":{"type":"string"}},"mitre_techniques":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"remediation":{"type":"string"},"extended_description":{"type":"string"},"impact":{"type":"string"},"id":{"type":"integer","description":"Internal numeric ID of the issue."},"last_update_timestamp":{"type":"integer","format":"int64"},"tags":{"type":"array","items":{"type":"string"}},"is_excluded":{"type":"boolean"},"is_starred":{"type":"boolean"},"assigned_to":{"type":"string"},"assigned_to_pretty":{"type":"string"},"status.progress":{"type":"string","description":"Current status of the issue. Built-in values are 'New', 'In Progress', and 'Resolved'. Additional custom statuses may be configured per tenant.","enum":["New","In Progress","Resolved"]},"status.resolution_reason":{"type":"string","description":"Resolution reason for resolved issues. Null when issue is not resolved. Built-in values are listed below. Additional values may be available depending on tenant configuration.","enum":["RESOLVED_THREAT_HANDLED","RESOLVED_KNOWN_ISSUE","RESOLVED_DUPLICATE","RESOLVED_FALSE_POSITIVE","RESOLVED_OTHER","RESOLVED_TRUE_POSITIVE","RESOLVED_SECURITY_TESTING","RESOLVED_RISK_ACCEPTED","RESOLVED_FIXED","RESOLVED_DISMISSED","RESOLVED_AUTO_RESOLVE"],"nullable":true},"status.resolution_comment":{"type":"string","description":"Free-text comment provided when resolving the issue. Null when the issue is not resolved or no comment was provided."},"severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"resolution_status_modified_ts":{"type":"integer","format":"int64","description":"Epoch timestamp in milliseconds when the resolution status was last modified."},"case_ids":{"type":"array","items":{"type":"integer"},"description":"List of case IDs this issue is associated with."},"initial_evidence":{"type":"string","description":"Initial evidence that triggered the issue."},"is_excepted":{"type":"boolean","description":"Indicates if the issue has an active exception."},"exception_ids":{"type":"array","items":{"type":"string"},"description":"List of exception IDs applied to this issue.","nullable":true},"exception_expiration":{"type":"integer","format":"int64","description":"Epoch timestamp in milliseconds when the exception expires.","nullable":true},"agentic_response_status":{"type":"string","description":"Status of the agentic response for this issue.","nullable":true},"agentic_assistant_id":{"type":"string","description":"ID of the agentic assistant handling this issue.","nullable":true},"agentic_response_conversation_id":{"type":"string","description":"Conversation ID for the agentic response.","nullable":true},"action_status":{"type":"string","description":"Current action status of the issue."},"asset_external_provider_ids":{"type":"array","items":{"type":"string"},"description":"List of external provider IDs for assets associated with the issue."},"asset_cloud_account_names":{"type":"array","items":{"type":"string"},"description":"List of cloud account names for assets associated with the issue."},"normalized_fields":{"$ref":"#/components/schemas/NormalizedFields"},"custom_fields":{"type":"object"}}},"NormalizedFields":{"type":"object","properties":{"xdm.source.location.country":{"type":"array","items":{"type":"string"}},"xdm.source.ipv4":{"type":"array","items":{"type":"string"}},"xdm.source.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.source.identity.username":{"type":"array","items":{"type":"string"}},"xdm.source.process.causality_id":{"type":"array","items":{"type":"string"}},"xdm.source.process.command_line":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.filename":{"type":"string"},"xdm.source.process.name":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.sha256":{"type":"array","items":{"type":"string"}},"xdm.source.host.hostname":{"type":"string"},"xdm.source.host.os_family":{"type":"string"},"xdm.source.agent.identifier":{"type":"string"},"xdm.source.agent.installation_id":{"type":"string"},"xdm.source.host.fqdn":{"type":"string"},"xdm.source.process.executable.signature_status":{"type":"array","items":{"type":"string"}},"xdm.target.file.filename":{"type":"array","items":{"type":"string"}},"xdm.target.module.filename":{"type":"string"},"xdm.target.file.sha256":{"type":"array","items":{"type":"string"}},"xdm.target.module.sha256":{"type":"string"},"xdm.target.process.command_line":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.sha256":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.signature_status":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.signer":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.target.ipv4":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv6_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.ipv6":{"type":"array","items":{"type":"string"}},"xdm.target.port":{"type":"array","items":{"type":"integer"}},"xdm.target.location.country":{"type":"string"},"xdm.target.host.hostname":{"type":"string"},"xdm.target.identity.username":{"type":"string"},"xdm.target.url":{"type":"string"},"xdm.target.process.executable.filename":{"type":"array","items":{"type":"string"}},"xdm.target.process.name":{"type":"string"},"xdm.target.agent.identifier":{"type":"string"},"xdm.target.registry.value":{"type":"array","items":{"type":"string"}},"xdm.target.registry.data":{"type":"array","items":{"type":"string"}},"xdm.target.registry.key":{"type":"array","items":{"type":"string"}},"xdm.email.attachment.sha256":{"type":"string"},"xdm.email.attachment.filename":{"type":"string"},"xdm.email.sender":{"type":"string"},"xdm.event.type":{"type":"string"},"xdm.cloud.provider":{"type":"string"},"xdm.cloud.project":{"type":"string"},"xdm.cloud.project_id":{"type":"string"},"xdm.cloud.region":{"type":"string"},"xdm.cloud.function.id":{"type":"string"},"xdm.cloud.function.name":{"type":"string"},"xdm.cloud.function.version":{"type":"string"},"xdm.cloud.function.request_id":{"type":"string"},"xdm.cloud.function.runtime":{"type":"string"},"xdm.observer.unique_identifier":{"type":"string"},"xdm.observer.type":{"type":"string"},"xdm.observer.sub_type":{"type":"string"},"xdm.observer.name":{"type":"string"},"xdm.vulnerability.cve_id":{"type":"string"},"xdm.vulnerability.severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"xdm.vulnerability.fix_versions":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cve_risk_factors":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cvss_score":{"type":"number","format":"float"},"xdm.vulnerability.cvss_vector":{"type":"string"},"xdm.software_package.version":{"type":"string"},"xdm.software_package.purl":{"type":"string"},"xdm.software_package.layer_id":{"type":"string"},"xdm.software_package.type":{"type":"string"},"xdm.software_package.installation_type":{"type":"string"},"xdm.software_package.package_manager":{"type":"string"},"xdm.software_package.dependency_type":{"type":"string"},"xdm.software_package.language":{"type":"string"},"xdm.malware.verdict":{"type":"string"},"xdm.malware.virus_total_link":{"type":"string"},"xdm.malware.layer_id":{"type":"string"},"xdm.secret.secret_type":{"type":"string"},"xdm.secret.unique_identifier":{"type":"string"},"xdm.secret.snippet":{"type":"string"},"xdm.secret.layer_id":{"type":"string"},"xdm.file.filename":{"type":"string"},"xdm.file.path":{"type":"array","items":{"type":"string"}},"xdm.file.sha256":{"type":"string"},"xdm.file.size":{"type":"integer"},"xdm.file.last_modified":{"type":"integer"},"xdm.file.metadata_change_time":{"type":"integer"},"xdm.file.owner_id":{"type":"string"},"xdm.file.owner_name":{"type":"string"},"xdm.file.group_id":{"type":"string"},"xdm.file.group_name":{"type":"string"},"xdm.file.permissions.owner":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.group":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.others":{"type":"array","items":{"type":"string"}},"xdm.file.position.start.line":{"type":"integer"},"xdm.file.position.start.character":{"type":"integer"},"xdm.file.position.end.line":{"type":"integer"},"xdm.file.position.end.character":{"type":"integer"},"xdm.url":{"type":"string"},"xdm.domain":{"type":"string"},"xdm.application_protocol":{"type":"string"}}}}}}
```

## The NormalizedFields object

```json
{"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"NormalizedFields":{"type":"object","properties":{"xdm.source.location.country":{"type":"array","items":{"type":"string"}},"xdm.source.ipv4":{"type":"array","items":{"type":"string"}},"xdm.source.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.source.identity.username":{"type":"array","items":{"type":"string"}},"xdm.source.process.causality_id":{"type":"array","items":{"type":"string"}},"xdm.source.process.command_line":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.filename":{"type":"string"},"xdm.source.process.name":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.sha256":{"type":"array","items":{"type":"string"}},"xdm.source.host.hostname":{"type":"string"},"xdm.source.host.os_family":{"type":"string"},"xdm.source.agent.identifier":{"type":"string"},"xdm.source.agent.installation_id":{"type":"string"},"xdm.source.host.fqdn":{"type":"string"},"xdm.source.process.executable.signature_status":{"type":"array","items":{"type":"string"}},"xdm.target.file.filename":{"type":"array","items":{"type":"string"}},"xdm.target.module.filename":{"type":"string"},"xdm.target.file.sha256":{"type":"array","items":{"type":"string"}},"xdm.target.module.sha256":{"type":"string"},"xdm.target.process.command_line":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.sha256":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.signature_status":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.signer":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.target.ipv4":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv6_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.ipv6":{"type":"array","items":{"type":"string"}},"xdm.target.port":{"type":"array","items":{"type":"integer"}},"xdm.target.location.country":{"type":"string"},"xdm.target.host.hostname":{"type":"string"},"xdm.target.identity.username":{"type":"string"},"xdm.target.url":{"type":"string"},"xdm.target.process.executable.filename":{"type":"array","items":{"type":"string"}},"xdm.target.process.name":{"type":"string"},"xdm.target.agent.identifier":{"type":"string"},"xdm.target.registry.value":{"type":"array","items":{"type":"string"}},"xdm.target.registry.data":{"type":"array","items":{"type":"string"}},"xdm.target.registry.key":{"type":"array","items":{"type":"string"}},"xdm.email.attachment.sha256":{"type":"string"},"xdm.email.attachment.filename":{"type":"string"},"xdm.email.sender":{"type":"string"},"xdm.event.type":{"type":"string"},"xdm.cloud.provider":{"type":"string"},"xdm.cloud.project":{"type":"string"},"xdm.cloud.project_id":{"type":"string"},"xdm.cloud.region":{"type":"string"},"xdm.cloud.function.id":{"type":"string"},"xdm.cloud.function.name":{"type":"string"},"xdm.cloud.function.version":{"type":"string"},"xdm.cloud.function.request_id":{"type":"string"},"xdm.cloud.function.runtime":{"type":"string"},"xdm.observer.unique_identifier":{"type":"string"},"xdm.observer.type":{"type":"string"},"xdm.observer.sub_type":{"type":"string"},"xdm.observer.name":{"type":"string"},"xdm.vulnerability.cve_id":{"type":"string"},"xdm.vulnerability.severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"xdm.vulnerability.fix_versions":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cve_risk_factors":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cvss_score":{"type":"number","format":"float"},"xdm.vulnerability.cvss_vector":{"type":"string"},"xdm.software_package.version":{"type":"string"},"xdm.software_package.purl":{"type":"string"},"xdm.software_package.layer_id":{"type":"string"},"xdm.software_package.type":{"type":"string"},"xdm.software_package.installation_type":{"type":"string"},"xdm.software_package.package_manager":{"type":"string"},"xdm.software_package.dependency_type":{"type":"string"},"xdm.software_package.language":{"type":"string"},"xdm.malware.verdict":{"type":"string"},"xdm.malware.virus_total_link":{"type":"string"},"xdm.malware.layer_id":{"type":"string"},"xdm.secret.secret_type":{"type":"string"},"xdm.secret.unique_identifier":{"type":"string"},"xdm.secret.snippet":{"type":"string"},"xdm.secret.layer_id":{"type":"string"},"xdm.file.filename":{"type":"string"},"xdm.file.path":{"type":"array","items":{"type":"string"}},"xdm.file.sha256":{"type":"string"},"xdm.file.size":{"type":"integer"},"xdm.file.last_modified":{"type":"integer"},"xdm.file.metadata_change_time":{"type":"integer"},"xdm.file.owner_id":{"type":"string"},"xdm.file.owner_name":{"type":"string"},"xdm.file.group_id":{"type":"string"},"xdm.file.group_name":{"type":"string"},"xdm.file.permissions.owner":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.group":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.others":{"type":"array","items":{"type":"string"}},"xdm.file.position.start.line":{"type":"integer"},"xdm.file.position.start.character":{"type":"integer"},"xdm.file.position.end.line":{"type":"integer"},"xdm.file.position.end.character":{"type":"integer"},"xdm.url":{"type":"string"},"xdm.domain":{"type":"string"},"xdm.application_protocol":{"type":"string"}}}}}}
```

## The IssueException object

```json
{"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"IssueException":{"type":"object","description":"Full issue exception object as returned by the public API","properties":{"exception_id":{"type":"integer","nullable":true,"description":"Auto-incremented exception ID"},"external_exception_id":{"type":"string","nullable":true,"description":"External tracking ID"},"name":{"type":"string","description":"Exception name"},"status":{"type":"string","enum":["APPROVED","DISABLED","EXPIRED","NO_DECISION_MADE","PENDING_DECISION","REJECTED","SELF_APPROVED"],"description":"Exception status"},"rule":{"type":"string","description":"JSON-encoded filter rule"},"pretty_rule":{"type":"string","nullable":true,"description":"Human-readable representation of the rule"},"justification_text":{"type":"string","description":"Justification text"},"justification_category":{"type":"string","enum":["COMPENSATING_CONTROL","PLANNED_REMEDIATION","RISK_ACCEPTED","VENDOR_DEPENDENCY"],"nullable":true,"description":"Justification category"},"approval_justification":{"type":"string","nullable":true,"description":"Approval decision justification"},"requestor_name":{"type":"string","description":"Name of the user who requested the exception"},"requestor_email":{"type":"string","description":"Email of the user who requested the exception"},"approver_email":{"type":"string","nullable":true,"description":"Email of the assigned approver"},"approver_name":{"type":"string","nullable":true,"description":"Name of the assigned approver"},"created_ts":{"type":"string","format":"date-time","nullable":true,"description":"Creation timestamp"},"modified_ts":{"type":"string","format":"date-time","nullable":true,"description":"Last modification timestamp"},"approval_ts":{"type":"string","format":"date-time","nullable":true,"description":"Approval decision timestamp"},"expiration_ts":{"type":"string","format":"date-time","description":"Exception expiration timestamp"},"impacted_issues_count":{"type":"integer","description":"Number of issues impacted by this exception"},"backward_scan_status":{"type":"string","enum":["COMPLETED","FAILED","IN_PROGRESS","PENDING"],"nullable":true,"description":"Status of backward scan"},"backward_scan_ts":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last backward scan"},"reversion_scan_status":{"type":"string","enum":["COMPLETED","FAILED","IN_PROGRESS","PENDING"],"nullable":true,"description":"Reversion scan status"},"reversion_scan_ts":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last reversion scan"}}}}}}
```

## The CreateIssueException object

```json
{"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"CreateIssueException":{"type":"object","description":"Request data for creating a new issue exception.","required":["name","rule","justification_text","justification_category","approver_email","expiration_ts"],"properties":{"name":{"type":"string","description":"Human-readable name for the exception"},"external_exception_id":{"type":"string","nullable":true,"description":"Optional external tracking ID for the exception"},"rule":{"type":"string","description":"JSON-encoded filter rule defining which issues this exception applies to. Uses the standard Cortex filter format with `AND`/`OR` structure. The value of each `SEARCH_FIELD` must be one of the supported field names — see [Issue exception supported fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/issues-apis/issues-papi-tables#supported-fields-for-issue-exception-filters) for the complete list."},"justification_text":{"type":"string","description":"Free-text justification explaining why this exception is needed"},"justification_category":{"type":"string","enum":["COMPENSATING_CONTROL","PLANNED_REMEDIATION","RISK_ACCEPTED","VENDOR_DEPENDENCY"],"description":"Category of justification for the exception"},"approval_justification":{"type":"string","description":"Free-text justification explaining why this exception is approved or rejected"},"approver_email":{"type":"string","description":"Email of the designated approver. Required when the tenant has approval workflow enabled. Must match a registered approver."},"expiration_ts":{"type":"string","format":"date-time","description":"Expiration date/time for the exception. Accepts ISO 8601 date-time or date-only format. Date-only values are normalized to end-of-day UTC (23:59:59)."}}}}}}
```

## The CreateIssue object

```json
{"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"CreateIssue":{"type":"object","properties":{"owner":{"type":"string"},"name":{"type":"string"},"description":{"type":"string"},"observation_time":{"type":"integer","format":"int64"},"issue_domain":{"type":"string","description":"Issue domain. Note: The create request uses `issue_domain` as the field name, while the search response returns this value as `domain`."},"category":{"type":"string"},"asset_ids":{"type":"array","items":{"type":"string"}},"mitre_tactics":{"type":"array","items":{"type":"string"}},"mitre_techniques":{"type":"array","items":{"type":"string"}},"type":{"type":"string"},"remediation":{"type":"string"},"extended_description":{"type":"string"},"impact":{"type":"string"},"initial_evidence":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"is_excluded":{"type":"boolean"},"is_starred":{"type":"boolean"},"assigned_to":{"type":"string"},"assigned_to_pretty":{"type":"string"},"severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"normalized_fields":{"$ref":"#/components/schemas/NormalizedFields"},"custom_fields":{"type":"object"}},"required":["name","description","observation_time","issue_domain","category","severity"]},"NormalizedFields":{"type":"object","properties":{"xdm.source.location.country":{"type":"array","items":{"type":"string"}},"xdm.source.ipv4":{"type":"array","items":{"type":"string"}},"xdm.source.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.source.identity.username":{"type":"array","items":{"type":"string"}},"xdm.source.process.causality_id":{"type":"array","items":{"type":"string"}},"xdm.source.process.command_line":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.filename":{"type":"string"},"xdm.source.process.name":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.source.process.executable.sha256":{"type":"array","items":{"type":"string"}},"xdm.source.host.hostname":{"type":"string"},"xdm.source.host.os_family":{"type":"string"},"xdm.source.agent.identifier":{"type":"string"},"xdm.source.agent.installation_id":{"type":"string"},"xdm.source.host.fqdn":{"type":"string"},"xdm.source.process.executable.signature_status":{"type":"array","items":{"type":"string"}},"xdm.target.file.filename":{"type":"array","items":{"type":"string"}},"xdm.target.module.filename":{"type":"string"},"xdm.target.file.sha256":{"type":"array","items":{"type":"string"}},"xdm.target.module.sha256":{"type":"string"},"xdm.target.process.command_line":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.sha256":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.signature_status":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.signer":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.target.ipv4":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv6_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.ipv6":{"type":"array","items":{"type":"string"}},"xdm.target.port":{"type":"array","items":{"type":"integer"}},"xdm.target.location.country":{"type":"string"},"xdm.target.host.hostname":{"type":"string"},"xdm.target.identity.username":{"type":"string"},"xdm.target.url":{"type":"string"},"xdm.target.process.executable.filename":{"type":"array","items":{"type":"string"}},"xdm.target.process.name":{"type":"string"},"xdm.target.agent.identifier":{"type":"string"},"xdm.target.registry.value":{"type":"array","items":{"type":"string"}},"xdm.target.registry.data":{"type":"array","items":{"type":"string"}},"xdm.target.registry.key":{"type":"array","items":{"type":"string"}},"xdm.email.attachment.sha256":{"type":"string"},"xdm.email.attachment.filename":{"type":"string"},"xdm.email.sender":{"type":"string"},"xdm.event.type":{"type":"string"},"xdm.cloud.provider":{"type":"string"},"xdm.cloud.project":{"type":"string"},"xdm.cloud.project_id":{"type":"string"},"xdm.cloud.region":{"type":"string"},"xdm.cloud.function.id":{"type":"string"},"xdm.cloud.function.name":{"type":"string"},"xdm.cloud.function.version":{"type":"string"},"xdm.cloud.function.request_id":{"type":"string"},"xdm.cloud.function.runtime":{"type":"string"},"xdm.observer.unique_identifier":{"type":"string"},"xdm.observer.type":{"type":"string"},"xdm.observer.sub_type":{"type":"string"},"xdm.observer.name":{"type":"string"},"xdm.vulnerability.cve_id":{"type":"string"},"xdm.vulnerability.severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"xdm.vulnerability.fix_versions":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cve_risk_factors":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cvss_score":{"type":"number","format":"float"},"xdm.vulnerability.cvss_vector":{"type":"string"},"xdm.software_package.version":{"type":"string"},"xdm.software_package.purl":{"type":"string"},"xdm.software_package.layer_id":{"type":"string"},"xdm.software_package.type":{"type":"string"},"xdm.software_package.installation_type":{"type":"string"},"xdm.software_package.package_manager":{"type":"string"},"xdm.software_package.dependency_type":{"type":"string"},"xdm.software_package.language":{"type":"string"},"xdm.malware.verdict":{"type":"string"},"xdm.malware.virus_total_link":{"type":"string"},"xdm.malware.layer_id":{"type":"string"},"xdm.secret.secret_type":{"type":"string"},"xdm.secret.unique_identifier":{"type":"string"},"xdm.secret.snippet":{"type":"string"},"xdm.secret.layer_id":{"type":"string"},"xdm.file.filename":{"type":"string"},"xdm.file.path":{"type":"array","items":{"type":"string"}},"xdm.file.sha256":{"type":"string"},"xdm.file.size":{"type":"integer"},"xdm.file.last_modified":{"type":"integer"},"xdm.file.metadata_change_time":{"type":"integer"},"xdm.file.owner_id":{"type":"string"},"xdm.file.owner_name":{"type":"string"},"xdm.file.group_id":{"type":"string"},"xdm.file.group_name":{"type":"string"},"xdm.file.permissions.owner":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.group":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.others":{"type":"array","items":{"type":"string"}},"xdm.file.position.start.line":{"type":"integer"},"xdm.file.position.start.character":{"type":"integer"},"xdm.file.position.end.line":{"type":"integer"},"xdm.file.position.end.character":{"type":"integer"},"xdm.url":{"type":"string"},"xdm.domain":{"type":"string"},"xdm.application_protocol":{"type":"string"}}}}}}
```

## The IssueSchemaField object

```json
{"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"IssueSchemaField":{"type":"object","properties":{"field_name":{"type":"string"},"field_pretty_name":{"type":"string"},"data_type":{"type":"string"}}}}}}
```

## The UpdateIssue object

```json
{"openapi":"3.0.0","info":{"title":"Issues API","version":"Cortex XSIAM 3.5"},"components":{"schemas":{"UpdateIssue":{"type":"object","description":"At least one of `severity` or `status` must be provided. When setting `status` to `Resolved`, the `status_resolution_reason` field is required.","properties":{"severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"status":{"type":"string","enum":["New","In Progress","Resolved"]},"status_resolution_reason":{"type":"string","description":"Resolution reason when status is set to 'Resolved'. Required when resolving an issue. Built-in values are listed below. Additional values such as 'Resolved - Risk Accepted', 'Resolved - Fixed', and 'Resolved - Dismissed' may be available depending on tenant licensing. Values are case-insensitive.","enum":["Resolved - Threat Handled","Resolved - Known Issue","Resolved - Duplicate Issue","Resolved - False Positive","Resolved - Other","Resolved - True Positive","Resolved - Security Testing","Resolved - Risk Accepted","Resolved - Fixed","Resolved - Dismissed"]},"status_resolution_comment":{"type":"string"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/issues-apis/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.