Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Jobs

APIs for managing jobs

Create a new job

post

Create a new job.

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Body
ownerstringOptional
typestringOptional
namestringOptional
playbookIdstringOptional
CustomFieldsobjectOptional
scheduledstringOptional
recurrentstringOptional
startDatestringOptional
endingDatestringOptional
endingTypestringOptional
timesintegerOptional
cronstringOptional
cronViewstringOptional
humanCronobjectOptional
tagsobject[]Optional
isFeedstringOptional
selectedFeedsobject[]Optional
isAllFeedsstringOptional
shouldTriggerNewstringOptional
closePrevRunstringOptional
notifyOwnerstringOptional
severitystring · nullableOptional
rolesany · nullableOptional
detailsany · nullableOptional
phaseany · nullableOptional
labelsany · nullableOptional
Responses
200

OK

application/json
idstringOptional
versionintegerOptional
cacheVersnintegerOptional
sequenceNumberintegerOptional
primaryTermintegerOptional
modifiedstringOptional
sizeInBytesintegerOptional
CustomFieldsobjectOptional
accountstringOptional
autimeintegerOptional
typestringOptional
rawTypestringOptional
namestringOptional
rawNamestringOptional
statusintegerOptional
custom_statusstringOptional
resolution_statusstringOptional
reasonstringOptional
createdstringOptional
occurredstringOptional
closedstringOptional
slaintegerOptional
severityintegerOptional
investigationIdstringOptional
labelsnullOptional
attachmentnullOptional
detailsstringOptional
openDurationintegerOptional
lastOpenstringOptional
closingUserIdstringOptional
ownerstringOptional
activatedstringOptional
closeReasonstringOptional
rawCloseReasonstringOptional
closeNotesstringOptional
playbookIdstringOptional
dueDatestringOptional
reminderstringOptional
runStatusstringOptional
notifyTimestringOptional
phasestringOptional
rawPhasestringOptional
isPlaygroundstringOptional
rawJSONstringOptional
parentstringOptional
parentXDRIncidentstringOptional
retainedstringOptional
categorystringOptional
rawCategorystringOptional
linkedIncidentsnullOptional
linkedCountintegerOptional
droppedCountintegerOptional
sourceInstancestringOptional
sourceBrandstringOptional
canvasesnullOptional
lastJobRunTimestringOptional
feedBasedstringOptional
dbotMirrorIdstringOptional
dbotMirrorInstancestringOptional
dbotMirrorDirectionstringOptional
dbotDirtyFieldsnullOptional
dbotCurrentDirtyFieldsnullOptional
dbotMirrorTagsnullOptional
dbotMirrorLastSyncstringOptional
isDebugstringOptional
startDatestringOptional
timesintegerOptional
recurrentstringOptional
endingDatestringOptional
humanCronobjectOptional
timezoneOffsetintegerOptional
cronViewstringOptional
scheduledstringOptional
scheduledEntryGuidstringOptional
minutesToTimeoutintegerOptional
descriptionstringOptional
currentIncidentIdstringOptional
isCurrentIncidentManualstringOptional
lastRunTimestringOptional
nextRunTimestringOptional
displayNextRunTimestringOptional
disabledNextRunTimestringOptional
schedulingStatusstringOptional
previousRunStatusstringOptional
tagsobject[]Optional
shouldTriggerNewstringOptional
closePrevRunstringOptional
notifyOwnerstringOptional
isFeedstringOptional
selectedFeedsobject[]Optional
isAllFeedsstringOptional
post/xsoar/public/v1/jobs
POST /xsoar/public/v1/jobs HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 529

{
  "owner": "user@company.com",
  "type": "default_type",
  "name": "CgdohXyI",
  "playbookId": "e5f722d0-3c93-49f0-8f11-89dbd221f7fe",
  "CustomFields": {},
  "scheduled": "False",
  "recurrent": "False",
  "startDate": "1970-01-01T00:00:00Z",
  "endingDate": "1970-01-01T00:00:00Z",
  "endingType": "",
  "times": 0,
  "cron": "",
  "cronView": "False",
  "humanCron": {},
  "tags": [],
  "isFeed": "False",
  "selectedFeeds": [],
  "isAllFeeds": "False",
  "shouldTriggerNew": "False",
  "closePrevRun": "False",
  "notifyOwner": "False",
  "severity": null,
  "roles": null,
  "details": null,
  "phase": null,
  "labels": null
}
200

OK

{
  "id": "24efaeb2-fb7b-430c-86c4-38ee7322988f",
  "version": 1,
  "cacheVersn": 0,
  "sequenceNumber": 49177488,
  "primaryTerm": 12,
  "modified": "2024-04-14T11:25:04.411266388Z",
  "sizeInBytes": 2123,
  "CustomFields": {},
  "account": "",
  "autime": 1713093904411258400,
  "type": "default_type",
  "rawType": "default_type",
  "name": "CgdohXyI",
  "rawName": "CgdohXyI",
  "status": 0,
  "custom_status": "",
  "resolution_status": "",
  "reason": "",
  "created": "2024-04-14T11:25:04.4112584Z",
  "occurred": "0001-01-01T00:00:00Z",
  "closed": "0001-01-01T00:00:00Z",
  "sla": 0,
  "severity": 0,
  "investigationId": "",
  "labels": null,
  "attachment": null,
  "details": "",
  "openDuration": 0,
  "lastOpen": "0001-01-01T00:00:00Z",
  "closingUserId": "",
  "owner": "user@company.com",
  "activated": "0001-01-01T00:00:00Z",
  "closeReason": "",
  "rawCloseReason": "",
  "closeNotes": "",
  "playbookId": "e5f722d0-3c93-49f0-8f11-89dbd221f7fe",
  "dueDate": "0001-01-01T00:00:00Z",
  "reminder": "0001-01-01T00:00:00Z",
  "runStatus": "idle",
  "notifyTime": "0001-01-01T00:00:00Z",
  "phase": "",
  "rawPhase": "",
  "isPlayground": "False",
  "rawJSON": "",
  "parent": "24efaeb2-fb7b-430c-86c4-38ee7322988f",
  "parentXDRIncident": "",
  "retained": "False",
  "category": "job",
  "rawCategory": "job",
  "linkedIncidents": null,
  "linkedCount": 0,
  "droppedCount": 0,
  "sourceInstance": "",
  "sourceBrand": "",
  "canvases": null,
  "lastJobRunTime": "0001-01-01T00:00:00Z",
  "feedBased": "False",
  "dbotMirrorId": "",
  "dbotMirrorInstance": "",
  "dbotMirrorDirection": "",
  "dbotDirtyFields": null,
  "dbotCurrentDirtyFields": null,
  "dbotMirrorTags": null,
  "dbotMirrorLastSync": "0001-01-01T00:00:00Z",
  "isDebug": "False",
  "startDate": "1970-01-01T00:00:00Z",
  "times": 0,
  "recurrent": "False",
  "endingDate": "1970-01-01T00:00:00Z",
  "humanCron": {},
  "timezoneOffset": 0,
  "cronView": "False",
  "scheduled": "False",
  "scheduledEntryGuid": "",
  "minutesToTimeout": 0,
  "description": "",
  "currentIncidentId": "",
  "isCurrentIncidentManual": "False",
  "lastRunTime": "0001-01-01T00:00:00Z",
  "nextRunTime": "0001-01-01T00:00:00Z",
  "displayNextRunTime": "0001-01-01T00:00:00Z",
  "disabledNextRunTime": "0001-01-01T00:00:00Z",
  "schedulingStatus": "idle",
  "previousRunStatus": "",
  "tags": [],
  "shouldTriggerNew": "False",
  "closePrevRun": "False",
  "notifyOwner": "False",
  "isFeed": "False",
  "selectedFeeds": [],
  "isAllFeeds": "False"
}

Delete the specified job

delete

Delete the job specified by its ID.

Path parameters
job_idstringRequired
Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Responses
200

OK

application/json
objectOptional
delete/xsoar/public/v1/jobs/{job_id}
DELETE /xsoar/public/v1/jobs/{job_id} HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Accept: */*
200

OK

{}

Sets the specified job to the specified status

post

Sets the specified job to the specified status. For example, can be used to run a job by setting the specified job to run operation.

Path parameters
operationstring · enumRequiredPossible values:
job_idstringRequired
Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Responses
200

OK

application/json
idstringOptional
versionintegerOptional
cacheVersnintegerOptional
modifiedstringOptional
createdstringOptional
sizeInBytesintegerOptional
CustomFieldsobjectOptional
accountstringOptional
autimeintegerOptional
typestringOptional
rawTypestringOptional
namestringOptional
rawNamestringOptional
statusintegerOptional
reasonstringOptional
occurredstringOptional
closedstringOptional
slaintegerOptional
severityintegerOptional
investigationIdstringOptional
labelsnullOptional
attachmentnullOptional
detailsstringOptional
openDurationintegerOptional
lastOpenstringOptional
closingUserIdstringOptional
ownerstringOptional
activatedstringOptional
closeReasonstringOptional
rawCloseReasonstringOptional
closeNotesstringOptional
playbookIdstringOptional
dueDatestringOptional
reminderstringOptional
runStatusstringOptional
notifyTimestringOptional
phasestringOptional
rawPhasestringOptional
isPlaygroundstringOptional
rawJSONstringOptional
parentstringOptional
categorystringOptional
rawCategorystringOptional
linkedIncidentsnullOptional
linkedCountintegerOptional
droppedCountintegerOptional
sourceInstancestringOptional
sourceBrandstringOptional
canvasesnullOptional
lastJobRunTimestringOptional
feedBasedstringOptional
dbotMirrorIdstringOptional
dbotMirrorInstancestringOptional
dbotMirrorDirectionstringOptional
dbotDirtyFieldsnullOptional
dbotCurrentDirtyFieldsnullOptional
dbotMirrorTagsnullOptional
dbotMirrorLastSyncstringOptional
isDebugstringOptional
startDatestringOptional
timesintegerOptional
recurrentstringOptional
endingDatestringOptional
humanCronobjectOptional
timezoneOffsetintegerOptional
cronViewstringOptional
scheduledstringOptional
minutesToTimeoutintegerOptional
descriptionstringOptional
currentIncidentIdstringOptional
isCurrentIncidentManualstringOptional
lastRunTimestringOptional
nextRunTimestringOptional
displayNextRunTimestringOptional
disabledNextRunTimestringOptional
schedulingStatusstringOptional
previousRunStatusstringOptional
tagsobject[]Optional
shouldTriggerNewstringOptional
closePrevRunstringOptional
notifyOwnerstringOptional
isFeedstringOptional
selectedFeedsobject[]Optional
isAllFeedsstringOptional
forceDisablestringOptional
post/xsoar/public/v1/jobs/{operation}/{job_id}
POST /xsoar/public/v1/jobs/{operation}/{job_id} HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Accept: */*
200

OK

{
  "id": "6bed6ebf-8a0e-4f0f-8af7-700625f89590",
  "version": 2,
  "cacheVersn": 0,
  "modified": "2024-04-14T12:40:57.504495219Z",
  "created": "2024-04-14T11:38:54.447885192Z",
  "sizeInBytes": 1455,
  "CustomFields": {},
  "account": "",
  "autime": 1713094734447885300,
  "type": "default_rocket_type",
  "rawType": "default_rocket_type",
  "name": "rocket_L2HNhsHP",
  "rawName": "rocket_L2HNhsHP",
  "status": 0,
  "reason": "",
  "occurred": "0001-01-01T00:00:00Z",
  "closed": "0001-01-01T00:00:00Z",
  "sla": 0,
  "severity": 0,
  "investigationId": "",
  "labels": null,
  "attachment": null,
  "details": "",
  "openDuration": 0,
  "lastOpen": "0001-01-01T00:00:00Z",
  "closingUserId": "",
  "owner": "user@company.com",
  "activated": "0001-01-01T00:00:00Z",
  "closeReason": "",
  "rawCloseReason": "",
  "closeNotes": "",
  "playbookId": "e0e54979-6d07-4546-8025-34b184e1bfee",
  "dueDate": "0001-01-01T00:00:00Z",
  "reminder": "0001-01-01T00:00:00Z",
  "runStatus": "running",
  "notifyTime": "0001-01-01T00:00:00Z",
  "phase": "",
  "rawPhase": "",
  "isPlayground": "false",
  "rawJSON": "",
  "parent": "6bed6ebf-8a0e-4f0f-8af7-700625f89590",
  "category": "job",
  "rawCategory": "job",
  "linkedIncidents": null,
  "linkedCount": 0,
  "droppedCount": 0,
  "sourceInstance": "",
  "sourceBrand": "",
  "canvases": null,
  "lastJobRunTime": "0001-01-01T00:00:00Z",
  "feedBased": "false",
  "dbotMirrorId": "",
  "dbotMirrorInstance": "",
  "dbotMirrorDirection": "",
  "dbotDirtyFields": null,
  "dbotCurrentDirtyFields": null,
  "dbotMirrorTags": null,
  "dbotMirrorLastSync": "0001-01-01T00:00:00Z",
  "isDebug": "false",
  "startDate": "1970-01-01T00:00:00Z",
  "times": 0,
  "recurrent": "false",
  "endingDate": "1970-01-01T00:00:00Z",
  "humanCron": {},
  "timezoneOffset": 0,
  "cronView": "false",
  "scheduled": "false",
  "minutesToTimeout": 0,
  "description": "",
  "currentIncidentId": "70402",
  "isCurrentIncidentManual": "true",
  "lastRunTime": "2024-04-14T12:40:57.504151826Z",
  "nextRunTime": "0001-01-01T00:00:00Z",
  "displayNextRunTime": "0001-01-01T00:00:00Z",
  "disabledNextRunTime": "0001-01-01T00:00:00Z",
  "schedulingStatus": "idle",
  "previousRunStatus": "idle",
  "tags": [],
  "shouldTriggerNew": "false",
  "closePrevRun": "false",
  "notifyOwner": "false",
  "isFeed": "false",
  "selectedFeeds": [],
  "isAllFeeds": "false",
  "forceDisable": "false"
}

Search for jobs

post

Search for jobs based on their ID.

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Body
pageintegerOptional

The page number of the results.

sizeintegerOptional

The number ofn results per page. Maximum: 50.

querystringOptional

The search string.

Example: "my_test_job"
Responses
200

OK

application/json
totalintegerOptional

The total number of jobs returned from the search query.

post/xsoar/public/v1/jobs/search
POST /xsoar/public/v1/jobs/search HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 83

{
  "page": 0,
  "size": 50,
  "query": "name:my_test_job",
  "sort": [
    {
      "field": "id",
      "asc": false
    }
  ]
}
200

OK

{
  "total": 1,
  "data": [
    {
      "id": "fcc1a411-46a7-4a35-8298-b4ba84870b6f",
      "version": 1,
      "cacheVersn": 0,
      "sequenceNumber": 49592072,
      "primaryTerm": 12,
      "modified": "2024-04-17T07:03:33.642761744Z",
      "sizeInBytes": 3395,
      "sortValues": [
        "-9223372036854775808"
      ],
      "CustomFields": {
        "actionsoncampaignincidents": "Close",
        "actionsonlowsimilarityincidents": "Add To Campaign",
        "chronicleautoblockentities": "Yes",
        "chronicleskipentityisolation": "Yes",
        "emaildeletefrombrand": "Unspecified",
        "emaildeletetype": "soft",
        "isactive": "true",
        "riskiqautoexcludewhitelistedipaddress": "Yes",
        "riskiqautowhitelistipaddress": "Yes",
        "fieldqku2kt7j": "8lraojiF",
        "fieldqxorthhx": "lE8MI7",
        "fieldqyeq7xpv": "Sj6ZQfYt",
        "fieldstsfbljv": "option_2lPBa2b4",
        "fieldudib0zul": "P0vSojZn",
        "fieldurfk9syh": "OnushD",
        "fieldv2iglhei": "ATGQkF",
        "fieldvh1ydrmm": "option_PKIbNz9h",
        "fieldwyw5iw48": "0xYBncbK",
        "fieldzgsjduqe": "lTsQkUAH",
        "saassecuritycategory": "no_reason",
        "saassecurityremediationtype": "Remove public sharing",
        "saassecuritystate": "open",
        "saassecuritystatus": "open-new",
        "selectaction": "Close",
        "servicenowbusinessimpact": "1 - Critical",
        "servicenowcategory": "Inquiry / Help",
        "servicenowimpact": "1 - High",
        "servicenownotify": "Send Email",
        "servicenowpriority": "1 - Critical",
        "servicenowseverity": "1 - High",
        "servicenowsircategory": "Confidential personal identity data exposure",
        "servicenowsirstate": "New",
        "servicenowstate": "1 - New",
        "servicenowurgency": "1 - High"
      },
      "account": "",
      "autime": 1713337413642754600,
      "type": "default_type",
      "rawType": "default_type",
      "name": "my_test_job",
      "rawName": "my_test_job",
      "status": 0,
      "custom_status": "",
      "resolution_status": "",
      "reason": "",
      "created": "2024-04-17T07:03:33.642754467Z",
      "occurred": "0001-01-01T00:00:00Z",
      "closed": "0001-01-01T00:00:00Z",
      "sla": 0,
      "severity": 0,
      "investigationId": "",
      "labels": null,
      "attachment": null,
      "details": "",
      "openDuration": 0,
      "lastOpen": "0001-01-01T00:00:00Z",
      "closingUserId": "",
      "owner": "user@company.com",
      "activated": "0001-01-01T00:00:00Z",
      "closeReason": "",
      "rawCloseReason": "",
      "closeNotes": "",
      "playbookId": "3CXDesktopApp Supply Chain Attack",
      "dueDate": "0001-01-01T00:00:00Z",
      "reminder": "0001-01-01T00:00:00Z",
      "runStatus": "idle",
      "notifyTime": "0001-01-01T00:00:00Z",
      "phase": "",
      "rawPhase": "",
      "isPlayground": false,
      "rawJSON": "",
      "parent": "fcc1a411-46a7-4a35-8298-b4ba84870b6f",
      "parentXDRIncident": "",
      "retained": false,
      "category": "job",
      "rawCategory": "job",
      "linkedIncidents": null,
      "linkedCount": 0,
      "droppedCount": 0,
      "sourceInstance": "",
      "sourceBrand": "",
      "canvases": null,
      "lastJobRunTime": "0001-01-01T00:00:00Z",
      "feedBased": false,
      "dbotMirrorId": "",
      "dbotMirrorInstance": "",
      "dbotMirrorDirection": "",
      "dbotDirtyFields": null,
      "dbotCurrentDirtyFields": null,
      "dbotMirrorTags": null,
      "dbotMirrorLastSync": "0001-01-01T00:00:00Z",
      "isDebug": false,
      "startDate": "2024-04-30T07:03:13Z",
      "endingType": "never",
      "times": 0,
      "recurrent": false,
      "endingDate": "2024-04-17T07:03:05Z",
      "humanCron": {},
      "timezoneOffset": -180,
      "cronView": false,
      "timezone": "Asia/Jerusalem",
      "scheduled": true,
      "scheduledEntryGuid": "",
      "minutesToTimeout": 0,
      "description": "",
      "currentIncidentId": "",
      "isCurrentIncidentManual": false,
      "lastRunTime": "0001-01-01T00:00:00Z",
      "nextRunTime": "2024-04-30T07:03:13Z",
      "displayNextRunTime": "2024-04-30T07:03:13Z",
      "disabledNextRunTime": "0001-01-01T00:00:00Z",
      "schedulingStatus": "idle",
      "previousRunStatus": "",
      "tags": [],
      "shouldTriggerNew": false,
      "closePrevRun": false,
      "notifyOwner": false,
      "isFeed": false,
      "selectedFeeds": [],
      "isAllFeeds": false
    }
  ]
}
PreviousInvestigations
NextLists

Last updated

Was this helpful?