v2_alerts_get_alerts_multi_events
Retrieve alerts with multiple events from Cortex XSIAM, applying filters with AND logic and pagination to get up to 100 results.
Instructions
Get Alerts Multi-Events v2
Get a list of alerts with multiple events.
The response is concatenated using AND condition (OR is not supported).
The maximum result set size is 100.
Offset is the zero-based number of alerts from the start of the result set.
Cortex XDR displays in the API response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.
Note: You can send a request to retrieve either all or filtered results.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v2/alerts/get_alerts_multi_events] · Incidents
Example request body:
{
"request_data": {
"filters": [
{
"field": "severity",
"operator": "in",
"value": [
"medium",
"high"
]
}
]
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | Yes | A dictionary containing the API request fields. An empty dictionary returns all results. |