Incident Fields
APIs for managing incident fields
Sets the select values of a specific tags field. The values passed to the route override the existing select values of the field. To reset the select values pass an empty array.
Authorizations
AuthorizationstringRequired
Path parameters
idstringRequired
The machine name of the field prefixed with the type. For example indicator_tags or incident_dbotmirrortags
Body
datastring[]Optional
Responses
200
empty
No content
post/incidentfield/tags/reset/{id}
POST /incidentfield/tags/reset/{id} HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 17
{
"data": [
"text"
]
}200
empty
No content
Get all incident fields associated with incident type
Authorizations
AuthorizationstringRequired
Path parameters
typestringRequired
the name (case sensitive) of the incident type
Responses
200
Returns a list of incident fields associated with the incident type
application/json
aliasTostringOptional
associatedToAllbooleanOptional
associatedTypesstring[]Optional
AssociatedTypes - list of incident (case) types IDs related to specific incident field
autoCompleteTagsstring[]Optional
breachScriptstringOptional
cacheVersninteger · int64Optional
caseInsensitivebooleanOptional
cliNamestringOptional
closeFormbooleanOptional
commitMessagestringOptional
contentbooleanOptional
createdstring · date-timeOptional
definitionIdstringOptional
descriptionstringOptional
editFormbooleanOptional
fieldCalcScriptstringOptional
groupnumber · doubleOptional
FieldGroup is the field group
hiddenbooleanOptional
idstringOptional
indexNamestringOptional
isReadOnlybooleanOptional
lockedbooleanOptional
mergeStrategystringOptional
FieldMergeStrategy strategy for merging of indicator fields
modifiedstring · date-timeOptional
namestringOptional
neverSetAsRequiredbooleanOptional
numericIdinteger · int64Optional
openEndedbooleanOptional
orgTypestringOptional
ownerOnlybooleanOptional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
placeholderstringOptional
prevNamestringOptional
primaryTerminteger · int64Optional
propagationLabelsstring[]Optional
remotebooleanOptional
requiredbooleanOptional
runScriptAfterUpdatebooleanOptional
scriptstringOptional
selectValuesstring[]Optional
sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeInBytesinteger · int64Optional
slainteger · int64Optional
sortValuesstring[]Optional
syncHashstringOptional
systembooleanOptional
systemAssociatedTypesstring[]Optional
templatestringOptional
thresholdnumber · doubleOptional
typestringOptional
unmappedbooleanOptional
unsearchablebooleanOptional
useAsKpibooleanOptional
validatedErrorstringOptional
validationRegexstringOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
x2_fieldsstringOptional
get/incidentfields/associatedTypes/{type}
GET /incidentfields/associatedTypes/{type} HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
200
Returns a list of incident fields associated with the incident type
[
{
"aliasTo": "text",
"aliases": [
{
"cliName": "text",
"type": "text"
}
],
"associatedToAll": true,
"associatedTypes": [
"text"
],
"autoCompleteTags": [
"text"
],
"breachScript": "text",
"cacheVersn": 1,
"caseInsensitive": true,
"cliName": "text",
"closeForm": true,
"columns": [
{
"displayName": "text",
"fieldCalcScript": "text",
"isDefault": true,
"isReadOnly": true,
"key": "text",
"orgType": "text",
"required": true,
"script": "text",
"selectValues": [
"text"
],
"type": "text",
"width": 1
}
],
"commitMessage": "text",
"content": true,
"created": "2026-01-01T00:00:00.000Z",
"defaultRows": [
{
"ANY_ADDITIONAL_PROPERTY": {}
}
],
"definitionId": "text",
"description": "text",
"editForm": true,
"fieldCalcScript": "text",
"fromServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"group": 1,
"hidden": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"isReadOnly": true,
"itemVersion": {
"Digits": [
1
],
"Label": "text"
},
"locked": true,
"mergeStrategy": "text",
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"neverSetAsRequired": true,
"numericId": 1,
"openEnded": true,
"orgType": "text",
"ownerOnly": true,
"packID": "text",
"packName": "text",
"packPropagationLabels": [
"text"
],
"placeholder": "text",
"prevName": "text",
"primaryTerm": 1,
"propagationLabels": [
"text"
],
"remote": true,
"required": true,
"runScriptAfterUpdate": true,
"script": "text",
"selectValues": [
"text"
],
"sequenceNumber": 1,
"shouldCommit": true,
"sizeInBytes": 1,
"sla": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"system": true,
"systemAssociatedTypes": [
"text"
],
"template": "text",
"threshold": 1,
"toServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"type": "text",
"unmapped": true,
"unsearchable": true,
"useAsKpi": true,
"validatedError": "text",
"validationRegex": "text",
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": true,
"version": 1,
"x2_fields": "text"
}
]Import an incident field to Cortex XSOAR
Authorizations
AuthorizationstringRequired
Body
filestringOptional
file
Responses
200
The saved incident field
application/json
errorstringOptional
post/incidentfields/import
POST /incidentfields/import HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: multipart/form-data
Accept: */*
Content-Length: 15
{
"file": "text"
}200
The saved incident field
{
"error": "text",
"incidentFields": [
{
"aliasTo": "text",
"aliases": [
{
"cliName": "text",
"type": "text"
}
],
"associatedToAll": true,
"associatedTypes": [
"text"
],
"autoCompleteTags": [
"text"
],
"breachScript": "text",
"cacheVersn": 1,
"caseInsensitive": true,
"cliName": "text",
"closeForm": true,
"columns": [
{
"displayName": "text",
"fieldCalcScript": "text",
"isDefault": true,
"isReadOnly": true,
"key": "text",
"orgType": "text",
"required": true,
"script": "text",
"selectValues": [
"text"
],
"type": "text",
"width": 1
}
],
"commitMessage": "text",
"content": true,
"created": "2026-01-01T00:00:00.000Z",
"defaultRows": [
{
"ANY_ADDITIONAL_PROPERTY": {}
}
],
"definitionId": "text",
"description": "text",
"editForm": true,
"fieldCalcScript": "text",
"fromServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"group": 1,
"hidden": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"isReadOnly": true,
"itemVersion": {
"Digits": [
1
],
"Label": "text"
},
"locked": true,
"mergeStrategy": "text",
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"neverSetAsRequired": true,
"numericId": 1,
"openEnded": true,
"orgType": "text",
"ownerOnly": true,
"packID": "text",
"packName": "text",
"packPropagationLabels": [
"text"
],
"placeholder": "text",
"prevName": "text",
"primaryTerm": 1,
"propagationLabels": [
"text"
],
"remote": true,
"required": true,
"runScriptAfterUpdate": true,
"script": "text",
"selectValues": [
"text"
],
"sequenceNumber": 1,
"shouldCommit": true,
"sizeInBytes": 1,
"sla": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"system": true,
"systemAssociatedTypes": [
"text"
],
"template": "text",
"threshold": 1,
"toServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"type": "text",
"unmapped": true,
"unsearchable": true,
"useAsKpi": true,
"validatedError": "text",
"validationRegex": "text",
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": true,
"version": 1,
"x2_fields": "text"
}
]
}Last updated
Was this helpful?