# Incident Management - Multi Alerts

## Overview

Get a list of alerts with multiple events.

* The response is concatenated using AND condition (OR is not supported).
* The maximum result set size is 100.
* Offset is the zero-based number of alerts from the start of the result set.

Cortex XDR displays in the API response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.

Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB.

## Configuration

### Parameters

**Name** - domain

**Value** - `CortexXdrDomain`

### Secrets

* `CortexXDRAuthorization` will reference the Cortex XDR Authorization token.
* `CortexXDRAuthId` will reference the [Cortex XDR Authorization ID](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-your-Cortex-XDR-API-key-ID?contentId=GwbuuBI0cJvEhgDAelFiMw).

<figure><picture><source srcset="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2F9PJn0rMaI80G3G8Jmnha%2Fcrtdark.png?alt=media&#x26;token=398d8069-0508-44d0-9e18-8f42c101e8e8" media="(prefers-color-scheme: dark)"><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2F1abywaKJBgF4JZJjO4yq%2Fcortexlight.png?alt=media&#x26;token=dffb055d-50c4-4dd7-a71d-30271f59c638" alt=""></picture><figcaption></figcaption></figure>

To add a Secret, open the **Secret** fields and click **New secret**:

* Give the secret a **Name**.
* Turn off the **Expiration date** option.
* Click **Add new value** and paste the secret corresponding to the value.
* Click **Save**.

<figure><picture><source srcset="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FlUo7CuVpPgIVm5VNjLw6%2Fnenenew.png?alt=media&#x26;token=eb7a7231-0ac2-4099-93f9-18f9ead5add1" media="(prefers-color-scheme: dark)"><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FTSD53FxGQOjijA3W3DhE%2Fimage.png?alt=media&#x26;token=9941a3c0-100a-4759-b603-30079fbc90de" alt=""></picture><figcaption></figcaption></figure>

{% hint style="info" %}
Learn more about secrets in Onum in [this article](https://docs.onum.com/administration/global-settings/organization-settings/secrets-management).
{% endhint %}

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the Cortex incident Management fields, or simply paste the given YAML:

{% tabs %}
{% tab title="Config as YAML" %}
Toggle this **ON** to enable a free text field where you can paste your **Cortex XDR multi alerts** YAML.

```yaml
withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: Epoch
withAuthentication: false
withEnumerationPhase: false
collectionPhase:
  paginationType: "fromTo"
  limit: 100
  request:
    responseType: json
    method: "POST"
    url: "https://${parameters.CortexXdrDomain}/public_api/v2/alerts/get_alerts_multi_events"
    headers:
      - name: Accept
        value: "application/json"
      - name: Content-Type
        value: "application/json"
      - name: Authorization
        value: "${secrets.CortexXdrAuthorization}"
      - name: x-xdr-auth-id
        value: ${secrets.CortexXdrAuthId}
    bodyType: raw
    bodyRaw: |
      {
        "request_data": {
          "search_from": ${pagination.from},
          "search_to": ${pagination.to},
          "filters": [
            {
              "field": "creation_time",
              "operator": "lte",
              "value": ${temporalWindow.to}
            }
          ]
        }
      }
  output:
    select: ".reply.alerts"
    map: "."
    outputMode: "element"
```

{% endtab %}

{% tab title="Manually configure" %}
**Temporal Window**

Toggle **ON** to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

<figure><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FUWdCoNTFSL8uPTHAHMCP%2Fl1ight-medium%20(15)1.png?alt=media&#x26;token=b154f980-5a5c-44f2-8a3f-7b0882cf7ce1" alt=""><figcaption></figcaption></figure>

**Authentication Phase**

Off

#### **Enumeration Phase**

Off

#### **Collection Phase**

* **Pagination Type**<mark style="color:red;">**\***</mark>**&#x20;-** `fromTo`
* **Zero index**<mark style="color:red;">**\***</mark>**&#x20;-** false
* **Limit**<mark style="color:red;">**\***</mark>**&#x20;-** 100
* **Request**&#x20;
  * **Response Type**<mark style="color:red;">**\***</mark>**&#x20;-** JSON
  * **Method**<mark style="color:red;">**\***</mark>**&#x20;-** `POST`
  * **URL**<mark style="color:red;">**\***</mark>**&#x20;-** `https://${parameters.CortexXdrDomain}/public_api/v1/alerts/get_alerts`
  * **Headers**&#x20;
    * **Name** - Accept&#x20;
    * **Value** - `application/json`&#x20;
    * **Name** - Content-Type
    * **Value** - `application/json`&#x20;
    * **Name** - Authorization
    * **Value** - `${secrets.CortexXdrAuthorization}`
    * **Name** -  x-xdr-auth-id&#x20;
    * **Value** - `${secrets.CortexXdrAuthId}`
  * **Body type**<mark style="color:red;">**\***</mark>**&#x20;-** raw
  * **Body content**<mark style="color:red;">**\***</mark> - `{`\
    `"request_data": {`\
    `"search_from": ${pagination.from},`\
    `"search_to": ${pagination.to},`\
    `"filters": [`\
    `{`\
    `"field": "creation_time",`\
    `"operator": "lte",`\
    `"value": ${temporalWindow.to}`\
    `}`\
    `]`\
    `}`\
    `}`
* **Output**&#x20;
  * **Select -** `.reply.alerts`
  * **Map -** `.`
  * **Output Mode** - `element`

<figure><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FR2PSLyfC31u3RWeIZpn6%2F2025-06-26_15-46-08.png?alt=media&#x26;token=5c6b03fd-46d9-4bf2-8c8e-0d3cda5a1f38" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}

This HTTP Pull Listener now uses the data export API to extract events.&#x20;

Click **Create labels** to move on to the next step and define the required [Labels](https://docs.onum.com/the-workspace/listeners/labels) if needed.