> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/incidents.md). # Incidents APIs for managing incidents ## Create or update an incident > Manually create a new Cortex XSOAR incident or update an existing one.\ > \ > To update an existing incident, you must update the \`version\` parameter. For more information on updating the \`version\` parameter, see \[Optimistic locking and versioning]\(./docs/Optimistic-Locking-and-Versioning.md).\ > \ > To update incident custom fields, they must be in lowercase and without spaces. For example, "Scan IP" should be "scanip".\ > To get the actual key name, you can go to Cortex XSOAR CLI and run \`/incident\_add\` and look for the key that you would like to update.\ > \ > Use \`createInvestigation: true\` to start the investigation process automatically upon creating the new incident. This will also run the appropriate playbook based on the incident type. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incident":{"post":{"tags":["Incidents"],"summary":"Create or update an incident","description":"Manually create a new Cortex XSOAR incident or update an existing one.\n\nTo update an existing incident, you must update the `version` parameter. For more information on updating the `version` parameter, see [Optimistic locking and versioning](./docs/Optimistic-Locking-and-Versioning.md).\n\nTo update incident custom fields, they must be in lowercase and without spaces. For example, \"Scan IP\" should be \"scanip\".\nTo get the actual key name, you can go to Cortex XSOAR CLI and run `/incident_add` and look for the key that you would like to update.\n\nUse `createInvestigation: true` to start the investigation process automatically upon creating the new incident. This will also run the appropriate playbook based on the incident type. ","operationId":"createIncident","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateIncidentRequest"}}},"required":false},"responses":{"200":{"description":"Request processed successfully, but no incident was created. This can occur when conditions (for example, a pre-processing rule) prevent incident creation without generating an error.","content":{}},"201":{"description":"Incident created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentWrapper"}}}},"400":{"description":"Bad Request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}]}}},"components":{"schemas":{"CreateIncidentRequest":{"title":"CreateIncidentRequest","type":"object","required":["name"],"properties":{"closeNotes":{"type":"string","description":"Notes for closing the incident."},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)."},"closed":{"type":"string","description":"Use `createInvestigation: true` to start the investigation process automatically upon creating the new incident. This will also run the appropriate playbook based on the incident type. \r\nUse 'createInvestigation: false","format":"date-time"},"createInvestigation":{"type":"boolean","description":"Use `createInvestigation: true` to start the investigation process automatically upon creating the new incident. This will also run the appropriate playbook based on the incident type. "},"customFields":{"type":"object","additionalProperties":{"type":"object"}},"details":{"type":"string","description":"The details of the incident."},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"modified":{"type":"string","format":"date-time","description":"Date modified."},"name":{"type":"string","description":"Incident name."},"playbookId":{"type":"string","description":"The associated playbook for this incident."},"rawJSON":{"type":"string"},"reason":{"type":"string","description":"The reason an incident was closed."},"severity":{"$ref":"#/components/schemas/Severity"},"sla":{"$ref":"#/components/schemas/SLAState"},"status":{"$ref":"#/components/schemas/IncidentStatus"},"type":{"type":"string","description":"Incident type."}}},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"},"IncidentWrapper":{"type":"object","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"changeStatus":{"type":"string"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"insights":{"type":"integer","format":"uint64"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client"},"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"reply":{"title":"reply","type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}},"description":"The query result upon error."}}}} ``` ## Create an incident from JSON > Create a single incident from raw JSON. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incident/json":{"post":{"tags":["Incidents"],"summary":"Create an incident from JSON","description":"Create a single incident from raw JSON.","operationId":"createIncidentJson","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"all":{"type":"boolean"},"CustomFields":{"type":"object","properties":{"key":{"type":"string"}}},"overrideInvestigation":{"type":"boolean"},"closeNotes":{"type":"string"},"data":{"type":"object","properties":{"key":{"type":"string"}}},"columns":{"type":"array","items":{"type":"string"}},"line":{"type":"string"},"ids":{"type":"array","items":{"type":"string"}},"force":{"type":"boolean"},"originalIncidentId":{"type":"string"},"closeReason":{"type":"string"}}}}},"required":false},"responses":{"200":{"description":"IncidentWrapper","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentWrapper"}}}}}}}},"components":{"schemas":{"IncidentWrapper":{"type":"object","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"changeStatus":{"type":"string"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"insights":{"type":"integer","format":"uint64"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client"},"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"}}}} ``` ## Search incidents by filter > Search incidents across all indices. You can filter by multiple options.\ > \ > The maximum response size is 250 MB. If the response is larger than this, you will get an error response.\ > \ > \*\*Note:\*\* This endpoint is not supported in multi-tenant environments. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incidents/search":{"post":{"tags":["Incidents"],"summary":"Search incidents by filter","description":"Search incidents across all indices. You can filter by multiple options.\n\nThe maximum response size is 250 MB. If the response is larger than this, you will get an error response.\n\n**Note:** This endpoint is not supported in multi-tenant environments.","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"operationId":"searchIncidents","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SearchIncidentsData"}}},"required":true},"responses":{"200":{"description":"incidentSearchResponse","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/Incident"}},"total":{"type":"integer"}}}}}}}}}},"components":{"schemas":{"SearchIncidentsData":{"title":"SearchIncidentsData","type":"object","properties":{"filter":{"$ref":"#/components/schemas/IncidentFilter"}}},"IncidentFilter":{"title":"IncidentFilter","type":"object","description":"IncidentFilter allows for very simple filtering.","properties":{"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"details":{"type":"string"},"files":{"type":"array","items":{"type":"string"}},"fromDate":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"investigation":{"type":"array","items":{"type":"string"}},"level":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}},"name":{"type":"array","items":{"type":"string"}},"notInvestigation":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string","description":"If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value."},"reason":{"type":"array","items":{"type":"string"}},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 25.","format":"int64","default":25},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"type":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}}}},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"},"Incident":{"title":"Incident","type":"object","properties":{"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","description":"When was this created","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"Note: CustomFields (an optional generic object type) is missing from the following definition."},"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"}}}} ``` ## Create a new incident type > Create a new incident type. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incidenttype":{"post":{"tags":["Incidents"],"summary":"Create a new incident type","description":"Create a new incident type.","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"operationId":"createOrUpdateIncidentType","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentTypeRequest"}}},"required":false},"responses":{"200":{"description":"IncidentType","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentType"}}}}}}}},"components":{"schemas":{"IncidentTypeRequest":{"title":"IncidentTypeRequest","type":"object","properties":{"autorun":{"type":"boolean"},"closureScript":{"type":"string"},"extractSettings":{"$ref":"#/components/schemas/IncidentTypeExtractSettings"},"id":{"type":"string"},"layout":{"type":"string"},"name":{"type":"string"},"playbookId":{"type":"string"},"preProcessingScript":{"type":"string"},"sla":{"type":"integer","format":"int64"},"slaReminder":{"type":"integer","format":"int64"},"color":{"type":"string"}}},"IncidentTypeExtractSettings":{"title":"IncidentTypeExtractSettings","type":"object","properties":{"fieldCliNameToExtractSettings":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/FieldExtractSetting"}},"mode":{"$ref":"#/components/schemas/ExtractSettingsMode"}}},"FieldExtractSetting":{"title":"FieldExtractSetting","type":"object","properties":{"extractAsIsIndicatorTypeId":{"type":"string"},"extractIndicatorTypesIDs":{"type":"array","items":{"type":"string"}},"isExtractingAllIndicatorTypes":{"type":"boolean"}}},"ExtractSettingsMode":{"title":"ExtractSettingsMode","type":"string","description":""},"IncidentType":{"title":"IncidentType","type":"object","properties":{"autorun":{"type":"boolean"},"cacheVersn":{"type":"integer","format":"int64"},"closureScript":{"type":"string"},"color":{"type":"string"},"commitMessage":{"type":"string"},"days":{"type":"integer","format":"int64"},"daysR":{"type":"integer","format":"int64"},"default":{"type":"boolean"},"definitionId":{"type":"string"},"detached":{"type":"boolean"},"disabled":{"type":"boolean"},"extractSettings":{"$ref":"#/components/schemas/IncidentTypeExtractSettings"},"fromServerVersion":{"$ref":"#/components/schemas/Version"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"hours":{"type":"integer","format":"int64"},"hoursR":{"type":"integer","format":"int64"},"id":{"type":"string"},"itemVersion":{"$ref":"#/components/schemas/Version"},"layout":{"type":"string"},"locked":{"type":"boolean"},"modified":{"type":"string","format":"date-time"},"name":{"type":"string"},"numericId":{"type":"integer","format":"int64"},"onChangeRepAlg":{"$ref":"#/components/schemas/ReputationCalcAlg"},"packID":{"type":"string"},"packName":{"type":"string"},"packPropagationLabels":{"type":"array","items":{"type":"string"}},"playbookId":{"type":"string"},"preProcessingScript":{"type":"string"},"prevName":{"type":"string"},"primaryTerm":{"type":"integer","format":"int64"},"propagationLabels":{"type":"array","items":{"type":"string"}},"readonly":{"type":"boolean"},"remote":{"type":"boolean"},"reputationCalc":{"$ref":"#/components/schemas/ReputationCalcAlg"},"sequenceNumber":{"type":"integer","format":"int64"},"shouldCommit":{"type":"boolean"},"sla":{"type":"integer","format":"int64"},"slaReminder":{"type":"integer","format":"int64"},"sortValues":{"type":"array","items":{"type":"string"}},"syncHash":{"type":"string"},"system":{"type":"boolean"},"toServerVersion":{"$ref":"#/components/schemas/Version"},"vcShouldIgnore":{"type":"boolean"},"vcShouldKeepItemLegacyProdMachine":{"type":"boolean"},"version":{"type":"integer","format":"int64"},"weeks":{"type":"integer","format":"int64"},"weeksR":{"type":"integer","format":"int64"}},"description":""},"Version":{"title":"Version","type":"object","properties":{"Digits":{"type":"array","description":"WARNING: when adding new attributes or changing the names\nof the existing ones, remember to add support in UnmarshalJSON\nfor items that were exported by msgpack.","items":{"type":"integer","format":"int64"}},"Label":{"type":"string"}},"description":"Version represents a version."},"ReputationCalcAlg":{"type":"number","format":"double","title":"ReputationCalcAlg ..."}}}} ``` ## Close an incident > Close the specified incident and optionally set a closing note. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incident/close":{"post":{"summary":"Close an incident","tags":["Incidents"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"version":{"type":"integer"},"cacheVersn":{"type":"integer"},"modified":{"type":"string"},"sizeInBytes":{"type":"integer"},"dbotCreatedBy":{"type":"string"},"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"account":{"type":"string"},"autime":{"type":"integer"},"type":{"type":"string"},"rawType":{"type":"string"},"name":{"type":"string"},"rawName":{"type":"string"},"status":{"type":"integer"},"custom_status":{"type":"string"},"resolution_status":{"type":"string"},"reason":{"type":"string"},"created":{"type":"string"},"occurred":{"type":"string"},"closed":{"type":"string"},"sla":{"type":"integer"},"severity":{"type":"integer"},"investigationId":{"type":"string"},"labels":{"type":"array","items":{"$ref":"#/components/schemas/Label"}},"attachment":{"nullable":true},"details":{"type":"string"},"openDuration":{"type":"integer"},"lastOpen":{"type":"string"},"closingUserId":{"type":"string"},"owner":{"type":"string"},"activated":{"type":"string"},"closeReason":{"type":"string"},"rawCloseReason":{"type":"string"},"closeNotes":{"type":"string"},"playbookId":{"type":"string"},"dueDate":{"type":"string"},"reminder":{"type":"string"},"runStatus":{"type":"string"},"notifyTime":{"type":"string"},"phase":{"type":"string"},"rawPhase":{"type":"string"},"isPlayground":{"type":"boolean"},"rawJSON":{"type":"string"},"parent":{"type":"string"},"parentXDRIncident":{"type":"string"},"retained":{"type":"boolean"},"category":{"type":"string"},"rawCategory":{"type":"string"},"linkedIncidents":{"nullable":true},"linkedCount":{"type":"integer"},"droppedCount":{"type":"integer"},"sourceInstance":{"type":"string"},"sourceBrand":{"type":"string"},"canvases":{"nullable":true},"lastJobRunTime":{"type":"string"},"feedBased":{"type":"boolean"},"dbotMirrorId":{"type":"string"},"dbotMirrorInstance":{"type":"string"},"dbotMirrorDirection":{"type":"string"},"dbotDirtyFields":{"nullable":true},"dbotCurrentDirtyFields":{"nullable":true},"dbotMirrorTags":{"nullable":true},"dbotMirrorLastSync":{"type":"string"},"isDebug":{"type":"boolean"},"changeStatus":{"type":"string"},"insights":{"type":"integer"}}}}}}},"operationId":"post-incident-close","description":"Close the specified incident and optionally set a closing note.","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"CustomFields":{"$ref":"#/components/schemas/CustomFields"},"id":{"type":"string"},"closeNotes":{"type":"string"}}}}}}}}},"components":{"schemas":{"CustomFields":{"title":"CustomFields","type":"object","additionalProperties":{"type":"object","properties":{}},"description":"The keys should be the field's display name, all lowercase and without spaces. For example: Scan IP -> scanip\nTo get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update."},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}}}}} ``` ## Investigate an incident > Open an investigation of an incident. Its status will change to \*\*Active\*\* and the remediation process will start. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"},{"name":"Investigations","description":"APIs for managing playground investigations"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incident/investigate":{"post":{"summary":"Investigate an incident","tags":["Incidents","Investigations"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"null"},"id":{"type":"string"},"invPlaybook":{"type":"null"},"investigation":{"type":"object","properties":{"cacheVersn":{"type":"integer"},"category":{"type":"string"},"closed":{"type":"string"},"created":{"type":"string"},"creatingUserId":{"type":"string"},"dbotCreatedBy":{"type":"string"},"details":{"type":"string"},"entryUsers":{"type":"array","items":{"type":"string"}},"highPriority":{"type":"boolean"},"id":{"type":"string"},"isDebug":{"type":"boolean"},"lastOpen":{"type":"string"},"mirrorAutoClose":{"type":"null"},"mirrorTypes":{"type":"null"},"modified":{"type":"string"},"name":{"type":"string"},"rawCategory":{"type":"string"},"reason":{"type":"null"},"runStatus":{"type":"string"},"sizeInBytes":{"type":"integer"},"slackMirrorAutoClose":{"type":"boolean"},"slackMirrorType":{"type":"string"},"status":{"type":"integer"},"systems":{"type":"null"},"tags":{"type":"null"},"type":{"type":"integer"},"users":{"type":"array","items":{"type":"string"}},"version":{"type":"integer"}}},"version":{"type":"integer"}}}}}}},"operationId":"post-incident-investigate","description":"Open an investigation of an incident. Its status will change to **Active** and the remediation process will start.","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"version":{"type":"integer"}}}}}}}}}} ``` ## Get a specific incident > Get the incident details of the specified incident ID. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incident/load/{id}":{"get":{"summary":"Get a specific incident","tags":["Incidents"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Incident"}}}}},"operationId":"get-incident-load-id","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Get the incident details of the specified incident ID."}}},"components":{"schemas":{"Incident":{"title":"Incident","type":"object","properties":{"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","description":"When was this created","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"Note: CustomFields (an optional generic object type) is missing from the following definition."},"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"}}}} ``` ## Batch export incidents to CSV > Export a batch of incidents to a CSV file and receive the filename in response. You can then use \[Get incidents as a CSV file]\() to download the CSV file. > \ > You can define the columns as well as filter the incidents to be included in the CSV file. > \\ > > \ > \*\*Note: \*\* You can retrieve up to 10,000 incidents. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incident/batch/exportToCsv":{"post":{"summary":"Batch export incidents to CSV","tags":["Incidents"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"filename":{"type":"string","description":"The CSV filename. Use this filename as the path header in `/xsoar/public/v1/incidents/csv/{filename}`."}}}}}},"413":{"description":"Limit exceeded. Output file exceeded limit. Exported incidents reach limit [10,000].","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-incident-batch-exportToCsv","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Export a batch of incidents to a CSV file and receive the filename in response. You can then use [Get incidents as a CSV file](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/incidents#get-xsoar-public-v1-incident-csv-filename) to download the CSV file.\r\nYou can define the columns as well as filter the incidents to be included in the CSV file.\r\n\r\n**Note: ** You can retrieve up to 10,000 incidents.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDataBatch"}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}},"description":"The query result upon error."},"UpdateDataBatch":{"type":"object","title":"UpdateDataBatch ...","properties":{"CustomFields":{"type":"object","additionalProperties":{"type":"object"}},"all":{"type":"boolean","description":"When `all` is `true`, all of the incidents are exported to CSV. \r\n\r\n**Note:** When `all`:`true`, all settings relating to page size and number are ignored."},"closeNotes":{"type":"string"},"closeReason":{"type":"string"},"columns":{"type":"array","items":{"type":"string"}},"data":{"type":"object","additionalProperties":{"type":"object"}},"filter":{"$ref":"#/components/schemas/IncidentFilter"},"force":{"type":"boolean"},"ids":{"type":"array","description":"Specify the list of incident IDs to be included in the CSV file. \r\n\r\n**Note:** When you choose to specify the IDs, all settings relating to page size and number are ignored.","items":{"type":"string"}},"line":{"type":"string"},"originalIncidentId":{"type":"string"},"overrideInvestigation":{"type":"boolean"}}},"IncidentFilter":{"title":"IncidentFilter","type":"object","description":"IncidentFilter allows for very simple filtering.","properties":{"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"details":{"type":"string"},"files":{"type":"array","items":{"type":"string"}},"fromDate":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"investigation":{"type":"array","items":{"type":"string"}},"level":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}},"name":{"type":"array","items":{"type":"string"}},"notInvestigation":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string","description":"If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value."},"reason":{"type":"array","items":{"type":"string"}},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 25.","format":"int64","default":25},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"type":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}}}},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"}}}} ``` ## Get incidents as a CSV file > Download the incident details in a CSV file format after preparing it by calling the \[Batch export incidents to CSV]\() API endpoint. The response of that call contains the prepared incident report filename with a timestamp. Use that filename as the path parameter in this API endpoint to download the file. > \\ > > \ > Note: To use cURL to run this command, add the \`-O\` curl command for downloading a file to the current folder, or \`-o /my\_custom\_location/my\_custom\_name.csv\` to customize the destination of the downloaded file. > \ > For example: > \ > \`\`\` curl > \ > curl "; > \ > -H 'content-type: application/json' > \ > -H 'accept: application/json' > \ > -H "Authorization:$api\_key" > \ > -H "x-xdr-auth-id:$api\_key\_id" > \ > -O > \ > \`\`\` ````json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incident/csv/{filename}":{"get":{"summary":"Get incidents as a CSV file","tags":["Incidents"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"file":{"type":"string","format":"binary"}}}}},"headers":{}}},"operationId":"get-incident-csv-id","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Download the incident details in a CSV file format after preparing it by calling the [Batch export incidents to CSV](https://app.gitbook.com/s/dXXxClt1YkGQlGTYJWdB/cortex-xsoar-8.x-apis/incidents#post-xsoar-public-v1-incident-batch-exporttocsv) API endpoint. The response of that call contains the prepared incident report filename with a timestamp. Use that filename as the path parameter in this API endpoint to download the file.\r\n\r\nNote: To use cURL to run this command, add the `-O` curl command for downloading a file to the current folder, or `-o /my_custom_location/my_custom_name.csv` to customize the destination of the downloaded file.\r\nFor example:\r\n``` curl\r\ncurl \"https://api-yourfqdn/xsoar/public/v1/incident/csv/incidents_report_Thu_18_Apr_2024_10_06_04_UTC.csv\" \r\n-H 'content-type: application/json' \r\n-H 'accept: application/json' \r\n-H \"Authorization:$api_key\" \r\n-H \"x-xdr-auth-id:$api_key_id\" \r\n-O \r\n```"}}}} ```` ## Update incidents in a batch > Update a batch of incidents. > \\ > > \ > To update custom fields, add \`CustomFields\` under the \`data\` parameter (the top-level \`CutomFields\` parameter is not used in this API). To update incident custom fields, make them lowercase and remove all spaces. For example: "Scan IP" -> "scanip". > \ > Alternatively, to get the actual key name, use the Cortex XSOAR CLI to run \`/incident\_add\` and look for the key that you would like to update. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incident/batch":{"post":{"summary":"Update incidents in a batch","tags":["Incidents"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentSearchResponseWrapper"}}}}},"operationId":"post-xsoar-public-v1-incident-batch","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Update a batch of incidents.\r\n\r\nTo update custom fields, add `CustomFields` under the `data` parameter (the top-level `CutomFields` parameter is not used in this API). To update incident custom fields, make them lowercase and remove all spaces. For example: \"Scan IP\" -> \"scanip\".\r\nAlternatively, to get the actual key name, use the Cortex XSOAR CLI to run `/incident_add` and look for the key that you would like to update.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDataBatch"}}}}}}},"components":{"schemas":{"IncidentSearchResponseWrapper":{"description":"IncidentSearchResponseWrapper is an extension for the IncidentSearchResponse type, which holds list of IncidentWrapper(s)","type":"object","properties":{"accountErrors":{"type":"array","items":{"type":"string"}},"data":{"description":"in: body","type":"array","items":{"$ref":"#/components/schemas/IncidentWrapper"}},"notUpdated":{"type":"integer","format":"uint64"},"searchAfter":{"type":"array","items":{"type":"string"}},"searchAfterElastic":{"type":"array","items":{"type":"string"}},"searchBefore":{"type":"array","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","items":{"type":"string"}},"total":{"type":"integer","format":"int64"},"totalAccounts":{"type":"integer","format":"int64"}}},"IncidentWrapper":{"type":"object","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"changeStatus":{"type":"string"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"insights":{"type":"integer","format":"uint64"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client"},"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"},"UpdateDataBatch":{"type":"object","title":"UpdateDataBatch ...","properties":{"CustomFields":{"type":"object","additionalProperties":{"type":"object"}},"all":{"type":"boolean","description":"When `all` is `true`, all of the incidents are exported to CSV. \r\n\r\n**Note:** When `all`:`true`, all settings relating to page size and number are ignored."},"closeNotes":{"type":"string"},"closeReason":{"type":"string"},"columns":{"type":"array","items":{"type":"string"}},"data":{"type":"object","additionalProperties":{"type":"object"}},"filter":{"$ref":"#/components/schemas/IncidentFilter"},"force":{"type":"boolean"},"ids":{"type":"array","description":"Specify the list of incident IDs to be included in the CSV file. \r\n\r\n**Note:** When you choose to specify the IDs, all settings relating to page size and number are ignored.","items":{"type":"string"}},"line":{"type":"string"},"originalIncidentId":{"type":"string"},"overrideInvestigation":{"type":"boolean"}}},"IncidentFilter":{"title":"IncidentFilter","type":"object","description":"IncidentFilter allows for very simple filtering.","properties":{"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"details":{"type":"string"},"files":{"type":"array","items":{"type":"string"}},"fromDate":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"investigation":{"type":"array","items":{"type":"string"}},"level":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}},"name":{"type":"array","items":{"type":"string"}},"notInvestigation":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string","description":"If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value."},"reason":{"type":"array","items":{"type":"string"}},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 25.","format":"int64","default":25},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"type":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}}}},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"}}}} ``` ## Export an incident's history and workplan > Export the specified incident's history and workplan in a tar.gz file.\ > Note that only playbook task entries are returned. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/performance/incident/export/{incident_id}":{"get":{"summary":"Export an incident's history and workplan","tags":["Incidents"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"filename":{"type":"string","format":"binary","description":"A tar.gz file containing the JSON files with the incident's history."}}}}}}},"operationId":"get-xsoar-public_api-v1-performance-incident-export-incident_id","parameters":[{"schema":{"type":"string"},"in":"header","name":"authorization","description":"api_key","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"api_key_id","required":true}],"description":"Export the specified incident's history and workplan in a tar.gz file.\nNote that only playbook task entries are returned."}}}} ``` ## Delete a batch of incidents > Delete a batch of incidents. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incident/batchDelete":{"post":{"summary":"Delete a batch of incidents","tags":["Incidents"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentSearchResponseWrapper"}}}}},"operationId":"post-xsoar-public-v1-incident-batchDelete","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"description":"Delete a batch of incidents.","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDataBatch"}}}}}}},"components":{"schemas":{"IncidentSearchResponseWrapper":{"description":"IncidentSearchResponseWrapper is an extension for the IncidentSearchResponse type, which holds list of IncidentWrapper(s)","type":"object","properties":{"accountErrors":{"type":"array","items":{"type":"string"}},"data":{"description":"in: body","type":"array","items":{"$ref":"#/components/schemas/IncidentWrapper"}},"notUpdated":{"type":"integer","format":"uint64"},"searchAfter":{"type":"array","items":{"type":"string"}},"searchAfterElastic":{"type":"array","items":{"type":"string"}},"searchBefore":{"type":"array","items":{"type":"string"}},"searchBeforeElastic":{"type":"array","items":{"type":"string"}},"total":{"type":"integer","format":"int64"},"totalAccounts":{"type":"integer","format":"int64"}}},"IncidentWrapper":{"type":"object","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"changeStatus":{"type":"string"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"insights":{"type":"integer","format":"uint64"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client"},"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"},"UpdateDataBatch":{"type":"object","title":"UpdateDataBatch ...","properties":{"CustomFields":{"type":"object","additionalProperties":{"type":"object"}},"all":{"type":"boolean","description":"When `all` is `true`, all of the incidents are exported to CSV. \r\n\r\n**Note:** When `all`:`true`, all settings relating to page size and number are ignored."},"closeNotes":{"type":"string"},"closeReason":{"type":"string"},"columns":{"type":"array","items":{"type":"string"}},"data":{"type":"object","additionalProperties":{"type":"object"}},"filter":{"$ref":"#/components/schemas/IncidentFilter"},"force":{"type":"boolean"},"ids":{"type":"array","description":"Specify the list of incident IDs to be included in the CSV file. \r\n\r\n**Note:** When you choose to specify the IDs, all settings relating to page size and number are ignored.","items":{"type":"string"}},"line":{"type":"string"},"originalIncidentId":{"type":"string"},"overrideInvestigation":{"type":"boolean"}}},"IncidentFilter":{"title":"IncidentFilter","type":"object","description":"IncidentFilter allows for very simple filtering.","properties":{"andOp":{"type":"boolean"},"category":{"type":"array","items":{"type":"string"}},"details":{"type":"string"},"files":{"type":"array","items":{"type":"string"}},"fromDate":{"type":"string","format":"date-time"},"id":{"type":"array","items":{"type":"string"}},"investigation":{"type":"array","items":{"type":"string"}},"level":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}},"name":{"type":"array","items":{"type":"string"}},"notInvestigation":{"type":"array","items":{"type":"string"}},"page":{"type":"integer","description":"0-based page","format":"int64"},"period":{"$ref":"#/components/schemas/Period"},"query":{"type":"string","description":"If you include the `query` parameter, all other filter fields will be ignored. \nTo include the other filter fields, they must be included as part of the query used as the `query` value."},"reason":{"type":"array","items":{"type":"string"}},"size":{"maximum":10000,"type":"integer","description":"Size is limited to 10000. If not specified, it defaults to 25.","format":"int64","default":25},"sort":{"type":"array","description":"The sort order","items":{"$ref":"#/components/schemas/Order"}},"status":{"type":"array","items":{"$ref":"#/components/schemas/IncidentStatus"}},"timeFrame":{"$ref":"#/components/schemas/Duration"},"toDate":{"type":"string","format":"date-time"},"type":{"type":"array","items":{"type":"string"}},"urls":{"type":"array","items":{"type":"string"}}}},"Period":{"title":"Period","type":"object","properties":{"by":{"type":"string"},"byFrom":{"type":"string"},"byTo":{"type":"string"},"field":{"type":"string"},"fromValue":{"type":"string","format":"duration"},"toValue":{"type":"string","format":"duration"}},"description":"Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now."},"Order":{"title":"Order","type":"object","properties":{"asc":{"type":"boolean"},"field":{"type":"string"},"fieldType":{"type":"string"}},"description":"Order structure holds a sort field and the direction of sorting"},"Duration":{"title":"Duration","type":"integer","description":"A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.","format":"int64"}}}} ``` ## Upload a file to an incident > Add a file attachment to an incident. ```json {"openapi":"3.0.1","info":{"title":"Cortex XSOAR 8 API","version":"XSOAR 8 Cloud"},"tags":[{"name":"Incidents","description":"APIs for managing incidents"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/xsoar/public/v1/incident/upload/{incident_id}":{"post":{"summary":"Upload a file to an incident","tags":["Incidents"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentWrapper"}}}}},"operationId":"post-xsoar-public-v1-incident-upload-incident_id","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"description":"Add a file attachment to an incident.","requestBody":{"content":{"multipart/form-data":{"schema":{"type":"object","required":["file"],"properties":{"fileName":{"type":"string","description":"File name"},"fileComment":{"type":"string","description":"Comment to add to the file"},"field":{"type":"string","description":"Field name to hold the attachment details. If not specified, `attachment` is used."},"showMediaFile":{"type":"boolean","description":"Whether to show media files."},"last":{"type":"boolean","description":"If set to `true`, creates an investigation. This is used for uploading after creating an incident."},"file":{"type":"string","description":"File","format":"binary"}}}}}}}}},"components":{"schemas":{"IncidentWrapper":{"type":"object","properties":{"ShardID":{"type":"integer","format":"int64"},"account":{"type":"string","description":"Account holds the tenant name so that slicing and dicing on the master can leverage bleve"},"activated":{"type":"string","description":"When was this activated","format":"date-time"},"activatingingUserId":{"type":"string","description":"The user that activated this investigation"},"allRead":{"type":"boolean"},"allReadWrite":{"type":"boolean"},"attachment":{"type":"array","description":"Attachments","items":{"$ref":"#/components/schemas/Attachment"}},"autime":{"type":"integer","description":"AlmostUniqueTime is an attempt to have a unique sortable ID for an incident","format":"int64"},"cacheVersn":{"type":"integer","format":"int64"},"canvases":{"type":"array","description":"Canvases of the incident","items":{"type":"string"}},"category":{"type":"string","description":"Category"},"changeStatus":{"type":"string"},"closeNotes":{"type":"string","description":"Notes for closing the incident"},"closeReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"closed":{"type":"string","description":"When was this closed","format":"date-time"},"closingUserId":{"type":"string","description":"The user ID that closed this investigation"},"created":{"type":"string","format":"date-time"},"dbotCreatedBy":{"type":"string","description":"Who has created this event - relevant only for manual incidents"},"dbotCurrentDirtyFields":{"type":"array","description":"For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration","items":{"type":"string"}},"dbotDirtyFields":{"type":"array","description":"For mirroring, manage a list of dirty fields to not override them from the source of the incident","items":{"type":"string"}},"dbotMirrorDirection":{"type":"string","description":"DBotMirrorDirection of how to mirror the incident (in/out/both)"},"dbotMirrorId":{"type":"string","description":"DBotMirrorID of a remote system we are syncing with"},"dbotMirrorInstance":{"type":"string","description":"DBotMirrorInstance name of a mirror integration instance"},"dbotMirrorLastSync":{"type":"string","description":"The last time we synced this incident even if we did not update anything","format":"date-time"},"dbotMirrorTags":{"type":"array","description":"The entry tags I want to sync to remote system","items":{"type":"string"}},"details":{"type":"string","description":"The details of the incident - reason, etc."},"droppedCount":{"type":"integer","description":"DroppedCount ...","format":"int64"},"dueDate":{"type":"string","description":"SLA","format":"date-time"},"feedBased":{"type":"boolean","description":"If this incident was triggered by a feed job"},"hasRole":{"type":"boolean","description":"Internal field to make queries on role faster"},"highlight":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}},"id":{"type":"string"},"indexName":{"type":"string"},"insights":{"type":"integer","format":"uint64"},"investigationId":{"type":"string","description":"Investigation that was opened as a result of the incoming event"},"isDebug":{"type":"boolean","description":"IsDebug ..."},"isPlayground":{"type":"boolean","description":"IsPlayGround"},"labels":{"type":"array","description":"Labels related to incident - each label is composed of a type and value","items":{"$ref":"#/components/schemas/Label"}},"lastJobRunTime":{"type":"string","description":"If this incident was triggered by a job, this would be the time the **previous** job started","format":"date-time"},"lastOpen":{"type":"string","format":"date-time"},"linkedCount":{"type":"integer","description":"LinkedCount ...","format":"int64"},"linkedIncidents":{"type":"array","description":"LinkedIncidents incidents that were marked as linked by user","items":{"type":"string"}},"modified":{"type":"string","format":"date-time"},"name":{"type":"string","description":"Incident Name - given by user"},"notifyTime":{"type":"string","description":"Incdicates when last this field was changed with a value that supposed to send a notification","format":"date-time"},"numericId":{"type":"integer","format":"int64"},"occurred":{"type":"string","description":"When this incident has really occurred","format":"date-time"},"openDuration":{"type":"integer","description":"Duration incident was open","format":"int64"},"owner":{"type":"string","description":"The user who owns this incident"},"parent":{"type":"string","description":"Parent"},"phase":{"type":"string","description":"Phase"},"playbookId":{"type":"string","description":"The associated playbook for this incident"},"previousAllRead":{"type":"boolean"},"previousAllReadWrite":{"type":"boolean"},"previousRoles":{"type":"array","description":"Do not change this field manually","items":{"type":"string"}},"primaryTerm":{"type":"integer","format":"int64"},"rawCategory":{"type":"string"},"rawCloseReason":{"type":"string","description":"The reason for closing the incident (select from existing predefined values)"},"rawJSON":{"type":"string"},"rawName":{"type":"string","description":"Incident RawName"},"rawPhase":{"type":"string","description":"RawPhase"},"rawType":{"type":"string","description":"Incident raw type"},"reason":{"type":"string","description":"The reason for the resolve"},"reminder":{"type":"string","description":"When if at all to send a reminder","format":"date-time"},"roles":{"type":"array","description":"The role assigned to this investigation","items":{"type":"string"}},"runStatus":{"$ref":"#/components/schemas/RunStatus"},"sequenceNumber":{"type":"integer","format":"int64"},"severity":{"$ref":"#/components/schemas/Severity"},"sizeInBytes":{"type":"integer","format":"int64"},"sla":{"$ref":"#/components/schemas/SLAState"},"sortValues":{"type":"array","items":{"type":"string"}},"sourceBrand":{"type":"string","description":"SourceBrand ..."},"sourceInstance":{"type":"string","description":"SourceInstance ..."},"status":{"$ref":"#/components/schemas/IncidentStatus"},"syncHash":{"type":"string"},"todoTaskIds":{"type":"array","description":"ToDoTaskIDs list of to do task ids","items":{"type":"string"}},"type":{"type":"string","description":"Incident type"},"version":{"type":"integer","format":"int64"},"xsoarHasReadOnlyRole":{"type":"boolean"},"xsoarPreviousReadOnlyRoles":{"type":"array","items":{"type":"string"}},"xsoarReadOnlyRoles":{"type":"array","items":{"type":"string"}}},"description":"IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client"},"Attachment":{"title":"Attachment","type":"object","properties":{"description":{"type":"string"},"isTempPath":{"type":"boolean"},"name":{"type":"string"},"path":{"type":"string"},"showMediaFile":{"type":"boolean"},"type":{"type":"string"}},"description":""},"Label":{"title":"Label","type":"object","properties":{"type":{"type":"string"},"value":{"type":"string"}}},"RunStatus":{"title":"RunStatus","type":"string","description":"Run status of a job."},"Severity":{"title":"Severity","maximum":4,"minimum":0,"type":"number","description":"Severity is the incident severity","format":"double"},"SLAState":{"title":"SLAState","type":"number","description":"SLAState is the incident SLA at closure time, in minutes.","format":"double"},"IncidentStatus":{"title":"IncidentStatus","maximum":2,"minimum":0,"type":"number","description":"IncidentStatus is the status of the incident","format":"double"}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/incidents.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.