incidents_get_incidents
Retrieve incidents from XSIAM filtered by incident IDs, creation time, or modification time. Supports pagination and sorting to manage large result sets.
Instructions
Get Incidents
Get a list of incidents filtered by a list of incident IDs, modification time, or creation time. This includes all incident types and severities, including correlation-generated incidents.
The response is concatenated using AND condition (OR is not supported).
The maximum result set size is >100.
Offset is the zero-based number of incidents from the start of the result set.
Note: You can send a request to retrieve either all or filtered results.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/incidents/get_incidents] · Incidents
Example request body:
{
"request_data": {
"filters": [
{
"field": "incident_id_list",
"operator": "in",
"value": [
"<incident ID>",
"<incident ID>"
]
}
],
"search_from": 0,
"search_to": 100,
"sort": {
"field": "creation_time",
"keyword": "desc"
}
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | No | A dictionary containing the API request fields. An empty dictionary returns all results. |