# Incident Management - Incidents

## Overview

Get a list of incidents filtered by a list of incident IDs, modification time, or creation time. This includes all incident types and severities, including correlation-generated incidents.

* The response is concatenated using AND condition (OR is not supported).
* The maximum result set size is >100.
* Offset is the zero-based number of incidents from the start of the result set.

## Configuration

### Parameters

**Name** - domain

**Value** - `CortexXdrDomain`

### Secrets

* `CortexXDRAuthorization` will reference the Cortex XDR Authorization token.
* `CortexXDRAuthId` will reference the [Cortex XDR Authorization ID](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-your-Cortex-XDR-API-key-ID?contentId=GwbuuBI0cJvEhgDAelFiMw).

<figure><picture><source srcset="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2F9PJn0rMaI80G3G8Jmnha%2Fcrtdark.png?alt=media&#x26;token=398d8069-0508-44d0-9e18-8f42c101e8e8" media="(prefers-color-scheme: dark)"><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2F1abywaKJBgF4JZJjO4yq%2Fcortexlight.png?alt=media&#x26;token=dffb055d-50c4-4dd7-a71d-30271f59c638" alt=""></picture><figcaption></figcaption></figure>

To add a Secret, open the **Secret** fields and click **New secret**:

* Give the secret a **Name**.
* Turn off the **Expiration date** option.
* Click **Add new value** and paste the secret corresponding to the value.
* Click **Save**.

<figure><picture><source srcset="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FlUo7CuVpPgIVm5VNjLw6%2Fnenenew.png?alt=media&#x26;token=eb7a7231-0ac2-4099-93f9-18f9ead5add1" media="(prefers-color-scheme: dark)"><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FTSD53FxGQOjijA3W3DhE%2Fimage.png?alt=media&#x26;token=9941a3c0-100a-4759-b603-30079fbc90de" alt=""></picture><figcaption></figcaption></figure>

{% hint style="info" %}
Learn more about secrets in Onum in [this article](https://docs.onum.com/administration/global-settings/organization-settings/secrets-management).
{% endhint %}

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the Cortex incident Management fields, or simply paste the given YAML:

{% tabs %}
{% tab title="Config as YAML" %}
Toggle this **ON** to enable a free text field where you can paste your **Cortex XDR multi alerts** YAML.

```yaml
withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: Epoch
withAuthentication: false
withEnumerationPhase: false
collectionPhase:
  paginationType: "fromTo"
  limit: 100
  request:
    method: "POST"
    url: "https://${parameters.CortexXdrDomain}/public_api/v1/incidents/get_incidents"
    headers:
      - name: Accept
        value: "application/json"
      - name: Content-Type
        value: "application/json"
      - name: Authorization
        value: "${secrets.CortexXdrAuthorization}"
      - name: x-xdr-auth-id
        value: ${secrets.CortexXdrAuthId}
    bodyType: raw
    bodyRaw: |
      {
        "request_data": {
          "search_from": ${pagination.from},
          "search_to": ${pagination.to},
          "filters": [
            {
              "field": "creation_time",
              "operator": "gte",
              "value": ${temporalWindow.from}000
            },
            {
              "field": "creation_time",
              "operator": "lte",
              "value": ${temporalWindow.to}000
            }
          ]
        }
      }
  output:
    select: ".reply.incidents"
    map: "."
    outputMode: "element"
```

{% endtab %}

{% tab title="Manually configure" %}
**Temporal Window**

Toggle **ON** to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

<figure><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FUWdCoNTFSL8uPTHAHMCP%2Fl1ight-medium%20(15)1.png?alt=media&#x26;token=b154f980-5a5c-44f2-8a3f-7b0882cf7ce1" alt=""><figcaption></figcaption></figure>

**Authentication Phase**

Off

#### **Enumeration Phase**

Off

#### **Collection Phase**

* **Pagination Type**<mark style="color:red;">**\***</mark>**&#x20;-** `fromTo`
* **Zero index**<mark style="color:red;">**\***</mark>**&#x20;-** false
* **Limit**<mark style="color:red;">**\***</mark>**&#x20;-** 100
* **Request**&#x20;
  * **Response Type**<mark style="color:red;">**\***</mark>**&#x20;-** JSON
  * **Method**<mark style="color:red;">**\***</mark>**&#x20;-** `POST`
  * **URL**<mark style="color:red;">**\***</mark>**&#x20;-** `https://${parameters.CortexXdrDomain}/public_api/v1/alerts/get_alerts`
  * **Headers**&#x20;
    * **Name** - Accept&#x20;
    * **Value** - `application/json`&#x20;
    * **Name** - Content-Type
    * **Value** - `application/json`&#x20;
    * **Name** - Authorization
    * **Value** - `${secrets.CortexXdrAuthorization}`
    * **Name** -  x-xdr-auth-id&#x20;
    * **Value** - `${secrets.CortexXdrAuthId}`
  * **Body type**<mark style="color:red;">**\***</mark>**&#x20;-** raw
  * **Body content**<mark style="color:red;">**\***</mark> - `{`\
    `"request_data": {`\
    `"search_from": ${pagination.from},`\
    `"search_to": ${pagination.to},`\
    `"filters": [`\
    `{`\
    `"field": "creation_time",`\
    `"operator": "gte",`\
    `"value": ${temporalWindow.from}000`\
    `},`\
    `{`\
    `"field": "creation_time",`\
    `"operator": "lte",`\
    `"value": ${temporalWindow.to}000`\
    `}`\
    `]`\
    `}`\
    `}`
* **Output**&#x20;
  * **Select -** `.reply.alerts`
  * **Map -** `.`
  * **Output Mode** - `element`

<figure><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2F7hpGCmi4bvYjEHz2oOzd%2F2025-06-26_15-46-08.png?alt=media&#x26;token=5cf26571-7863-4777-b177-d18145aff2c0" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}

This HTTP Pull Listener now uses the data export API to extract events.&#x20;

Click **Create labels** to move on to the next step and define the required [Labels](https://docs.onum.com/the-workspace/listeners/labels) if needed.