alerts_get_alerts
Retrieve all or filtered alerts from Cortex XSIAM. Supports filters, sorting, and pagination to efficiently access security alert data.
Instructions
Get all Alerts
Get a list of all or filtered alerts. The alerts listed are what remains after alert exclusions are applied by Cortex XSIAM.
Response is concatenated using AND condition (OR is not supported).
Maximum result set size is 100.
Offset is the zero-based number of alerts from the start of the result set. The response indicates whether an PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/alerts/get_alerts] · Incidents
Example request body:
{
"request_data": {
"filters": [
{
"field": "severity",
"operator": "in",
"value": [
"medium",
"high"
]
}
],
"search_from": 0,
"search_to": 5,
"sort": {
"field": "severity",
"keyword": "asc"
}
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | No |