Skip to main content
Search incidents with optional filtering. Important Note:
  • This action is not supported in multi tenant environments.
External DocumentationTo learn more, visit the Palo Alto Cortex Xsoar documentation.

​
Parameters

ParameterDescription
CategoriesA comma-separated list of incident categories to filter by.
DetailsA string to search and match in incident details.
File NamesA comma-separated list of file names to filter by.
FilterSelect whether to filter by query or by filtering criteria.
Filtering OperationSelect the filtering operation to use with the filtering criteria.
FromThe start of the timeframe to search incidents from.
IDsA comma-separated list of specific incident IDs to include in the response.
InvestigationsA comma-separated list of investigation IDs to filter by.
Investigations To ExcludeA comma-separated list of investigation IDs to exclude from the response.
LevelsA comma-separated list of severity levels to filter by.
NameA comma-separated list of names to filter by.
PageThe page number to return results from. Valid range is >=0.
PeriodA JSON object that represents the period query. For more information about Period please refer to Cortex XSOAR.
QueryFree-text query to search incident fields with.
ReasonsA comma-separated list of reasons to filter by.
SizeThe maximum number of incidents to return per page. Defaults to 25. Maximum value is 10000.
SortAn array of sorting criteria.

Note:
SSorting object must include field and asc (true/false) and an optional fieldType.
Statuses NumbersA comma-separated list of incident statuses to filter by.
TimeframeNumber of nanoseconds that represents time elapsed between two instants.
ToThe end of the timeframe to search incidents until.
TypesA comma-separated list of incident types to filter by.
URLsA comma-separated list of URL values to filter by.

​
Example Output

{
	"data": [
		{
			"account": "example",
			"activated": "2020-01-01T12:00:00Z",
			"activatingingUserId": "example",
			"allRead": false,
			"allReadWrite": false,
			"attachment": [
				{
					"description": "example",
					"isTempPath": false,
					"name": "example",
					"path": "example",
					"showMediaFile": false,
					"type": "example"
				}
			],
			"autime": 1682865388000000000,
			"cacheVersn": 0,
			"canvases": [
				"example"
			],
			"category": "example",
			"closeNotes": "example",
			"closeReason": "example",
			"closed": "2020-01-01T12:00:00Z",
			"closingUserId": "example",
			"created": "2020-01-01T12:00:00Z",
			"dbotCreatedBy": "example",
			"dbotCurrentDirtyFields": [
				"example"
			],
			"dbotDirtyFields": [
				"example"
			],
			"dbotMirrorDirection": "example",
			"dbotMirrorId": "example",
			"dbotMirrorInstance": "example",
			"dbotMirrorLastSync": "2020-01-01T12:00:00Z",
			"dbotMirrorTags": [
				"example"
			],
			"details": "example",
			"droppedCount": 0,
			"dueDate": "2020-01-01T12:00:00Z",
			"feedBased": false,
			"hasRole": false,
			"highlight": {
				"additionalProperties": [
					"example"
				]
			},
			"id": "example",
			"investigationId": "example",
			"isDebug": false,
			"isPlayground": false,
			"labels": [
				{
					"type": "example",
					"value": "example"
				}
			],
			"lastJobRunTime": "2020-01-01T12:00:00Z",
			"lastOpen": "2020-01-01T12:00:00Z",
			"linkedCount": 0,
			"linkedIncidents": [
				"example"
			],
			"modified": "2020-01-01T12:00:00Z",
			"name": "example",
			"notifyTime": "2020-01-01T12:00:00Z",
			"numericId": 0,
			"occurred": "2020-01-01T12:00:00Z",
			"openDuration": 0,
			"owner": "example",
			"parent": "example",
			"phase": "example",
			"playbookId": "example",
			"previousAllRead": false,
			"previousAllReadWrite": false,
			"previousRoles": [
				"example"
			],
			"primaryTerm": 0,
			"rawCategory": "example",
			"rawCloseReason": "example",
			"rawJSON": "example",
			"rawName": "example",
			"rawPhase": "example",
			"rawType": "example",
			"reason": "example",
			"reminder": "2020-01-01T12:00:00Z",
			"roles": [
				"example"
			],
			"runStatus": "example",
			"sequenceNumber": 0,
			"severity": 2,
			"sla": 0.1,
			"sortValues": [
				"example"
			],
			"sourceBrand": "example",
			"sourceInstance": "example",
			"status": 2,
			"syncHash": "example",
			"todoTaskIds": [
				"example"
			],
			"type": "example",
			"version": 0,
			"xsoarHasReadOnlyRole": false,
			"xsoarPreviousReadOnlyRoles": [
				"example"
			],
			"xsoarReadOnlyRoles": [
				"example"
			]
		}
	],
	"total": 0
}

​
Workflow Library Example

Search Incidents with Palo Alto Cortex Xsoar and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop