Incident Management - Multi Alerts
Overview
Get a list of alerts with multiple events.
The response is concatenated using AND condition (OR is not supported).
The maximum result set size is 100.
Offset is the zero-based number of alerts from the start of the result set.
Cortex XDR displays in the API response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.
Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB.
Configuration
Parameters
Secrets
After entering the required parameters and secrets, you can choose to manually enter the Cortex incident Management fields, or simply paste the given YAML:
Toggle this ON to enable a free text field where you can paste your Cortex XDR multi alerts YAML.
withTemporalWindow: true
temporalWindow:
duration: 5m
offset: 5m
tz: UTC
format: Epoch
withAuthentication: false
withEnumerationPhase: false
collectionPhase:
paginationType: "fromTo"
limit: 100
request:
responseType: json
method: "POST"
url: "https://${parameters.CortexXdrDomain}/public_api/v2/alerts/get_alerts_multi_events"
headers:
- name: Accept
value: "application/json"
- name: Content-Type
value: "application/json"
- name: Authorization
value: "${secrets.CortexXdrAuthorization}"
- name: x-xdr-auth-id
value: ${secrets.CortexXdrAuthId}
bodyType: raw
bodyRaw: |
{
"request_data": {
"search_from": ${pagination.from},
"search_to": ${pagination.to},
"filters": [
{
"field": "creation_time",
"operator": "lte",
"value": ${temporalWindow.to}
}
]
}
}
output:
select: ".reply.alerts"
map: "."
outputMode: "element"
This HTTP Pull Listener now uses the data export API to extract events.
Click Create labels to move on to the next step and define the required Labels if needed.
Last updated
Was this helpful?