> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/xsoar-8-tables.md). # Additional References ## Table for POST /xsoar/public/v1/indicators/feed/json | Property | Required? | Type | Notes | | -------------------- | --------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `value` | Required | string | | | `type` | Required | string | | | `score` | Optional | number | Possible values: 0-3. Default is 0, where `0` means None, `1` Good, `2` Suspicious, and `3` Bad | | `sourceBrand` | Optional | string | Default is `External` | | `sourceInstance` | Optional | string | Default is `External` | | `reliability` | Optional | string | Possible values: `A - Completely reliable`, `B - Usually reliable`, `C - Fairly reliable`, `D - Not usually reliable`, `E - Unreliable`, `F - Reliability cannot be judged` | | `expirationPolicy` | Optional | string | Possible values: `never`, `interval`, `indicatorType` | | `expirationInterval` | Optional | number | Interval in minutes | ## Incident Fields Table | Field | Value | | -------------------------------------------------------- | -------------------------------------------------------------- | | Incident Name | b | | Occurred | 2024-02-21 09:40:31.478767484 +0000 UTC | | Owner | | | Type | default\_rocket\_type | | Severity | Unknown | | Playbook | | | Phase | | | SolarWinds Event NetObject ID | 0 | | Xpanse Service Validation | \[{"columnheader1":""},{},{}] | | rocket\_field\_9cXC2WVD | 0 | | rocket\_field\_wXYX6uGG | 0 | | rocket\_field\_zfML4cE0 | false | | Select Action | Close | | rocket\_field\_42Q8Ri0W | Status: idle | | rocket\_field\_AaX9wGTe | \[{}] | | rocket\_field\_CfZmni5R | Status: idle | | rocket\_field\_qKCO0ydE | \[{}] | | rocket\_field\_tB9lEkl5 | 0 | | Campaign Email Sender Instance | rocket\_gmail\_instance\_5p8iV9OZ | | rocket\_field\_GKrAoBGl | 0 | | SolarWinds Instance Site ID | 0 | | Inventa Source | \[{}] | | rocket\_field\_ThpRM0UI | false | | rocket\_field\_Hx9VM4pC | false | | XM Cyber security score trend | 0 | | FortiSIEM Events | \[{}] | | rocket\_field\_02MXekkB | option\_f1kSTDSS | | Time to Assignment | Status: idle | | XDR Investigation results | \[{},{},{},{"columnheader1":""},{},{"columnheader1":""},{},{}] | | ServiceNow Severity | 1 - High | | rocket\_field\_iUoszZbg | Status: idle | | rocket\_field\_O1yXp4Dy | \[{}] | | Remediation SLA | Status: idle | | rocket\_field\_zGSjDuQE | rocket\_lTsQkUAH | | Datadog Cloud SIEM Customer Impacted | false | | Dataminr Pulse Related Terms | \[{},{},{}] | | RDPCacheHunting Strings Similarity | \[{},{},{}] | | rocket\_field\_Uo7LGQJ9 | 0 | | Email Delete From Brand | Unspecified | | rocket\_field\_C04gZmJA | 0 | | rocket\_field\_KetHuvYK | Status: idle | | rocket\_field\_BTdE7csG | 0 | | rocket\_field\_F1zOPNIb | 0 | | rocket\_field\_oOiSzo3v | false | | rocket\_field\_XrBpJHNc | \[{}] | | TheHive Flag | false | | Xpanse Service Classifications | \[{},{},{}] | | DBotPredictionProbability | 0 | | rocket\_field\_jbpBUEdw | Status: idle | | rocket\_field\_yfUtODrw | false | | SolarWinds Event Engine ID | 0 | | rocket\_field\_J8zKFsyM | \[{}] | | rocket\_field\_o4ZG2bvA | Status: idle | | rocket\_field\_PUfEsh2i | Status: idle | | ServiceNow Business Impact | 1 - Critical | | ServiceNow SIR State | New | | Datadog Cloud SIEM User Is Service | false | | Qintel QWatch Exposures | \[{},{},{}] | | rocket\_field\_yM2KVwjH | Status: idle | | Containment SLA | Status: idle | | External ID | 157448 | | rocket\_field\_DPma6rXc | \[{}] | | rocket\_field\_OhQJmX5W | false | | rocket\_field\_oq4Ib3Rq | Status: idle | | rocket\_field\_xSD42019 | 0 | | rocket\_field\_6mO51xzN | rocket\_2G5KQgOq | | rocket\_field\_jj5VB0LK | 0 | | rocket\_field\_FvAoEcwO | false | | rocket\_field\_oizBgs9u | 0 | | rocket\_field\_qUB0KXF8 | Status: idle | | rocket\_field\_RBxB2vfR | 0 | | rocket\_field\_8WNmYYVC | rocket\_30PKbAUW | | rocket\_field\_BMhsQOpn | Status: idle | | rocket\_field\_BZxREVRQ | Status: idle | | rocket\_field\_OUPkDDJ1 | Status: idle | | rocket\_field\_V2iGLhEi | ATGQkF | | rocket\_field\_xw7hSi6S | 0 | | AWS GuardDuty Confidence Score | 0 | | rocket\_field\_dIuCwG95 | 0 | | rocket\_field\_KUn3mu2U | false | | Cohesity Helios Cluster Id | 0 | | DeCYFIR Data Details | \[{},{},{}] | | rocket\_field\_wYw5IW48 | rocket\_0xYBncbK | | Datadog Cloud SIEM User Verified | false | | rocket\_field\_PHyIvfgh | rocket\_vvOoi235 | | XDR Starred | false | | ExtraHop Reveal(x) Mitre Techniques | \[{},{},{}] | | rocket\_field\_pN5NX1QC | 0 | | Incident Duration | Status: idle | | RiskIQ Auto Exclude Whitelisted IP Address | Yes | | rocket\_field\_cfDRG1gV | 0 | | ServiceNow Notify | Send Email | | rocket\_field\_f0mRcM8q | \[{}] | | rocket\_field\_NLyjpP21 | false | | rocket\_field\_4r4tIz6W | false | | Number of Related Incidents | 0 | | rocket\_field\_gCjnl61D | 0 | | rocket\_field\_JIaR3E0A | rocket\_12IRzenM | | rocket\_field\_PqKOFAv0 | 0 | | BmcITSM Customer | \[{}] | | rocket\_field\_uRfK9syH | OnushD | | CrowdStrike Falcon Behaviour Pattern Disposition Details | \[{},{},{}] | | rocket\_field\_BP7q7Pbn | 0 | | rocket\_field\_QyEq7XPv | rocket\_Sj6ZQfYt | | rocket\_field\_3RxB5haR | Status: idle | | rocket\_field\_EYInCU1N | false | | rocket\_field\_qp0o4lmH | rocket\_BlnkYAhj | | rocket\_field\_XYQyxhpn | 0 | | ServiceNow Impact | 1 - High | | ServiceNow Urgency | 1 - High | | rocket\_field\_eIxka2g7 | 0 | | rocket\_field\_MSXZnC2Y | 0 | | rocket\_field\_I3YadN4O | false | | rocket\_field\_Xf0uuduk | 0 | | Saas Security State | open | | RSA Metas Events | \[] | | ExtraHop Reveal(x) Detection Devices | \[{},{},{}] | | rocket\_field\_qku2KT7J | rocket\_8lraojiF | | rocket\_field\_XTmM8iX9 | Status: idle | | RiskIQ Auto Whitelist IP Address | Yes | | ServiceNow Priority | 1 - Critical | | rocket\_field\_XKEvyILP | 0 | | SolarWinds Alert Object ID | 0 | | Actions On Low Similarity Incidents | Add To Campaign | | rocket\_field\_9XA0O3nq | WZ3sR6 | | rocket\_field\_BxVy7ACI | Status: idle | | rocket\_field\_wAwulkZU | false | | CRYPTOSIM Correlation ID | 0 | | rocket\_field\_1m1nkNsl | rocket\_kUrYJCYH | | rocket\_field\_eyw5E4sM | 0 | | CRYPTOSIM Category ID | 0 | | rocket\_field\_aENrumCR | Uo3MEg | | rocket\_field\_a40b2sfG | 0 | | rocket\_field\_BTdE7csG | 0 | | rocket\_field\_oq4Ib3Rq | Status: idle | | Datadog Cloud SIEM Customer Impacted | false | | SolarWinds Event NetObject ID | 0 | | Chronicle Skip Entity Isolation | Yes | | DBotPredictionProbability | 0 | | Incident Duration | Status: idle | | rocket\_field\_qKCO0ydE | \[{}] | | Saas Security Remediation Type | Remove public sharing | | Cohesity Helios Cluster Id | 0 | | Inventa Source | \[{}] | | RiskIQ Auto Whitelist IP Address | Yes | | rocket\_field\_kpgyU158 | \[{}] | | rocket\_field\_XYQyxhpn | 0 | | rocket\_field\_VsEhZB8s | \[{}] | | Xpanse Service Classifications | \[{},{},{}] | | BmcITSM Customer | \[{}] | | rocket\_field\_yM2KVwjH | Status: idle | | CrowdStrike Falcon Behaviour Pattern Disposition Details | \[{},{},{}] | | rocket\_field\_H5KQJHzc | 0 | | rocket\_field\_OOBHWdtf | 0 | | rocket\_field\_tB9lEkl5 | 0 | | rocket\_field\_TZphELjw | Status: idle | | rocket\_field\_wYw5IW48 | rocket\_0xYBncbK | | rocket\_field\_zGSjDuQE | rocket\_lTsQkUAH | | ServiceNow SIR State | New | | rocket\_field\_f0mRcM8q | \[{}] | | rocket\_field\_JIaR3E0A | rocket\_12IRzenM | | Datadog Cloud SIEM Detect and Create Duration | 0 | | rocket\_field\_e2kKCGrH | 0 | | rocket\_field\_eyw5E4sM | 0 | | rocket\_field\_MSXZnC2Y | 0 | | XDR Alert Search Results | \[{},{},{}] | | rocket\_field\_BP7q7Pbn | 0 | | rocket\_field\_Hx9VM4pC | false | | rocket\_field\_QyEq7XPv | rocket\_Sj6ZQfYt | | rocket\_field\_aENrumCR | Uo3MEg | | rocket\_field\_OUPkDDJ1 | Status: idle | | Dataminr Pulse Related Terms | \[{},{},{}] | | Is VPN IP Address | false | | rocket\_field\_3RxB5haR | Status: idle | | rocket\_field\_F1zOPNIb | 0 | | rocket\_field\_Vh1YDrmm | option\_PKIbNz9h | | ExtraHop Reveal(x) Detection Devices | \[{},{},{}] | | rocket\_field\_CJNGZ1hr | false | | File Relationships | \[{},{},{}] | | rocket\_field\_pN5NX1QC | 0 | | rocket\_field\_qp0o4lmH | rocket\_BlnkYAhj | | rocket\_field\_SiqptQqU | 0 | | XM Cyber security score trend | 0 | | rocket\_field\_4r4tIz6W | false | | rocket\_field\_VX1MzTGQ | 0 | | SolarWinds Alert ID | 0 | | rocket\_field\_4EjUBigQ | 0 | | SolarWinds Acknowledged | false | | FortiSIEM Attack Tactics | \[{},{}] | | rocket\_field\_A28fG0OJ | Status: idle | | rocket\_field\_BtNdlwtX | 0 | | rocket\_field\_EYInCU1N | false | | rocket\_field\_FvAoEcwO | false | | Qintel QWatch Exposures | \[{},{},{}] | | rocket\_field\_RhblDnmx | 0 | | rocket\_field\_KetHuvYK | Status: idle | | rocket\_field\_XTmM8iX9 | Status: idle | | rocket\_field\_dIuCwG95 | 0 | | Number of similar files | 0 | | rocket\_field\_9cXC2WVD | 0 | | rocket\_field\_l9viBXoN | 0 | | RDPCacheHunting String Sifter | \[{},{},{}] | | rocket\_field\_bDvHqhgD | 0 | | rocket\_field\_gCjnl61D | 0 | | rocket\_field\_J8zKFsyM | \[{}] | | rocket\_field\_jj5VB0LK | 0 | | rocket\_field\_PUfEsh2i | Status: idle | | Containment SLA | Status: idle | | Suspicious Executions | \[{},{},{}] | | rocket\_field\_xw7hSi6S | 0 | | rocket\_field\_0QIeTiLT | \[{}] | | SolarWinds Alert Object ID | 0 | | SolarWinds Instance Site ID | 0 | | rocket\_field\_BMhsQOpn | Status: idle | | rocket\_field\_BZxREVRQ | Status: idle | | rocket\_field\_ptuLAVSO | false | | ServiceNow Priority | 1 - Critical | | test\_ivan | false | | Campaign Email Sender Instance | rocket\_gmail\_instance\_5p8iV9OZ | | rocket\_field\_dPYdb2Ts | rocket\_mCQCvo20 | | rocket\_field\_o4ZG2bvA | Status: idle | | SolarWinds Alert Related Node ID | 0 | | DomainToolsIrisDetect | \[{},{},{}] | | rocket\_field\_42Q8Ri0W | Status: idle | | rocket\_field\_qUB0KXF8 | Status: idle | | rocket\_field\_Uo7LGQJ9 | 0 | | Datadog Cloud SIEM User Verified | false | | rocket\_field\_82dossWp | 0 | | rocket\_field\_lYEffLPK | Status: idle | | SolarWinds Active Alert ID | 0 | | Datadog Cloud SIEM Repair Time | 0 | | rocket\_field\_1m1nkNsl | rocket\_kUrYJCYH | | rocket\_field\_7PRuMt0z | Status: idle | | ServiceNow SIR Category | Confidential personal identity data exposure | | Microsoft Sentinel Owner | \[] | | rocket\_field\_DiwD4Pdj | 0 | | rocket\_field\_mc5SBBxx | 0 | | rocket\_field\_mnUeZx1q | rocket\_bU5TjVJf | | rocket\_field\_nqJoEhXl | \[{}] | | ServiceNow Impact | 1 - High | | rocket\_field\_2f1RAM7U | false | | rocket\_field\_AaX9wGTe | \[{}] | | rocket\_field\_C04gZmJA | 0 | | Failed Logon Events | 0 | | rocket\_field\_oizBgs9u | 0 | | rocket\_field\_wXYX6uGG | 0 | | Select Action | Close | | SpyCloud Compass Device-Data | \[{},{},{}] | | Endpoint | \[{}] | | rocket\_field\_D9Wodnig | false | | rocket\_field\_RQsKWjv8 | \[{}] | | Detection SLA | Status: idle | | rocket\_field\_ThTTy9NN | false | | ServiceNow Notify | Send Email | | rocket\_field\_I3YadN4O | false | ## Label Type Table | Label Type | Value | | ---------- | ------------------ | | Instance | | | Brand | Manual | ## Field Changes Table Incident was modified. Field changes | Field | Old Value | New Value | | ------------- | --------- | --------------------- | | Closing Notes | | close\_note\_oAZROKPJ | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/xsoar-8-tables.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.