WebsiteBlogLogin

Incident Management - Incidents

Overview

Get a list of incidents filtered by a list of incident IDs, modification time, or creation time. This includes all incident types and severities, including correlation-generated incidents.

  • The response is concatenated using AND condition (OR is not supported).

  • The maximum result set size is >100.

  • Offset is the zero-based number of incidents from the start of the result set.

Configuration

Parameters

Name - domain

Value - CortexXdrDomain

Secrets

After entering the required parameters and secrets, you can choose to manually enter the Cortex incident Management fields, or simply paste the given YAML:

Toggle this ON to enable a free text field where you can paste your Cortex XDR multi alerts YAML.

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: Epoch
withAuthentication: false
withEnumerationPhase: false
collectionPhase:
  paginationType: "fromTo"
  limit: 100
  request:
    method: "POST"
    url: "https://${parameters.CortexXdrDomain}/public_api/v1/incidents/get_incidents"
    headers:
      - name: Accept
        value: "application/json"
      - name: Content-Type
        value: "application/json"
      - name: Authorization
        value: "${secrets.CortexXdrAuthorization}"
      - name: x-xdr-auth-id
        value: ${secrets.CortexXdrAuthId}
    bodyType: raw
    bodyRaw: |
      {
        "request_data": {
          "search_from": ${pagination.from},
          "search_to": ${pagination.to},
          "filters": [
            {
              "field": "creation_time",
              "operator": "gte",
              "value": ${temporalWindow.from}000
            },
            {
              "field": "creation_time",
              "operator": "lte",
              "value": ${temporalWindow.to}000
            }
          ]
        }
      }
  output:
    select: ".reply.incidents"
    map: "."
    outputMode: "element"

This HTTP Pull Listener now uses the data export API to extract events.

Click Create labels to move on to the next step and define the required Labels if needed.

PreviousIncident Management - Multi AlertsNextIncident Management - Incidents Extradata

Last updated

Was this helpful?