openapi: 3.1.0 info: title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Incidents API description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform. version: '1.0' contact: name: Palo Alto Networks Developer Support url: https://pan.dev/ license: name: Proprietary url: https://www.paloaltonetworks.com/legal servers: - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1 description: AIOps for NGFW BPA API production server. security: - oauth2Bearer: [] tags: - name: Incidents description: Incident management and investigation. paths: /incidents/get_incidents: post: operationId: getIncidents summary: Palo Alto Networks List Incidents description: Returns a list of incidents matching the specified filter criteria. Incidents group related alerts into a unified investigation context. Supports filtering by incident ID, status, severity, and creation time. tags: - Incidents requestBody: required: true content: application/json: schema: type: object properties: request_data: type: object properties: filters: type: array items: $ref: '#/components/schemas/Filter' description: Filter criteria to apply to the incident list. search_from: type: integer description: Pagination offset (zero-based). default: 0 search_to: type: integer description: Upper bound of the result range. default: 100 sort: $ref: '#/components/schemas/SortOrder' examples: GetIncidentsRequestExample: summary: Default getIncidents request x-microcks-default: true value: request_data: filters: - field: example-field operator: lte value: example-value - field: example-field operator: lte value: example-value search_from: 0 search_to: 100 sort: field: example-field keyword: asc responses: '200': description: Incidents returned successfully. content: application/json: schema: type: object properties: reply: type: object properties: total_count: type: integer result_count: type: integer incidents: type: array items: $ref: '#/components/schemas/Incident' examples: GetIncidents200Example: summary: Default getIncidents 200 response x-microcks-default: true value: reply: total_count: 176 result_count: 940 incidents: - incident_id: '877543' incident_name: Branch Gateway 82 description: Firewall traffic applied alert threat blocked Security rule. status: resolved_threat_handled severity: informational assigned_user_mail: analyst1@example.com assigned_user_pretty_name: Carlos Smith alert_count: 509 low_severity_alert_count: 929 med_severity_alert_count: 295 high_severity_alert_count: 602 critical_severity_alert_count: 936 user_count: 170 host_count: 720 creation_time: 1707012665747 modification_time: 1744706901976 detection_time: 1704757310414 starred: true xdr_url: https://portal.acme-systems.org/0455da rule_based_score: 942 manual_score: 174 '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '500': $ref: '#/components/responses/InternalServerError' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incidents/get_incident_extra_data: post: operationId: getIncidentExtraData summary: Palo Alto Networks Get Incident Details description: Returns detailed information about a specific incident including all associated alerts, network artifacts, file artifacts, and endpoint details. tags: - Incidents requestBody: required: true content: application/json: schema: type: object required: - request_data properties: request_data: type: object required: - incident_id properties: incident_id: type: string description: Unique identifier of the incident. alerts_limit: type: integer description: Maximum number of alerts to include in response. default: 1000 examples: GetIncidentExtraDataRequestExample: summary: Default getIncidentExtraData request x-microcks-default: true value: request_data: incident_id: '709824' alerts_limit: 1000 responses: '200': description: Incident details returned successfully. content: application/json: schema: type: object properties: reply: type: object properties: incident: $ref: '#/components/schemas/IncidentDetail' alerts: type: object properties: total_count: type: integer data: type: array items: $ref: '#/components/schemas/Alert' network_artifacts: type: object file_artifacts: type: object examples: GetIncidentExtraData200Example: summary: Default getIncidentExtraData 200 response x-microcks-default: true value: reply: incident: example-incident alerts: total_count: 428 data: - alert_id: '999423' detection_timestamp: 1733555086833 name: Staging Policy 70 category: custom description: Rule incident incident firewall suspicious monitoring activity threat rule monitoring suspicious detected. host_ip: - example-host_ip_item - example-host_ip_item host_name: Corporate Agent 14 user_name: jsmith mac: - example-mac_item source: example-source action: alert action_pretty: alert severity: informational matching_status: running alert_type: standard resolution_status: enabled resolution_comment: Monitoring threat applied Security investigation Security configured. network_artifacts: {} file_artifacts: {} '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incidents/update_incident: post: operationId: updateIncident summary: Palo Alto Networks Update Incident description: Updates the status, severity, assignee, or other mutable fields of a specific incident. Only the fields provided in the request body are modified. tags: - Incidents requestBody: required: true content: application/json: schema: type: object required: - request_data properties: request_data: type: object required: - incident_id properties: incident_id: type: string status: type: string enum: - new - under_investigation - resolved_threat_handled - resolved_known_issue - resolved_duplicate - resolved_false_positive - resolved_other severity: type: string enum: - high - medium - low assigned_user_mail: type: string description: Email of the user to assign the incident to. assigned_user_pretty_name: type: string resolve_comment: type: string description: Resolution comment (required when closing an incident). add_comment: type: string description: Comment to add to the incident timeline. examples: UpdateIncidentRequestExample: summary: Default updateIncident request x-microcks-default: true value: request_data: incident_id: '498189' status: resolved_duplicate severity: high assigned_user_mail: security-ops@example.com assigned_user_pretty_name: Jane Garcia resolve_comment: Detected endpoint configured policy firewall Security malware rule suspicious alert incident network. add_comment: Endpoint detected suspicious incident network firewall threat malware configured blocked alert investigation. responses: '200': description: Incident updated successfully. content: application/json: schema: type: object properties: reply: type: boolean examples: UpdateIncident200Example: summary: Default updateIncident 200 response x-microcks-default: true value: reply: true '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incident_management/get_incidents: post: operationId: getIncidents summary: Palo Alto Networks Get Attack Surface Incidents description: Returns a list of attack surface incidents. Xpanse incidents represent confirmed exposures that require remediation such as unintended services, misconfigured certificates, or shadow IT. Supports filtering by status, severity, type, and assignee. tags: - Incidents requestBody: required: true content: application/json: schema: type: object properties: request_data: type: object properties: filters: type: array items: $ref: '#/components/schemas/Filter_2' search_from: type: integer default: 0 search_to: type: integer default: 100 sort: $ref: '#/components/schemas/SortOrder_2' examples: GetIncidentsRequestExample: summary: Default getIncidents request x-microcks-default: true value: request_data: filters: - field: example-field operator: contains value: example-value - field: example-field operator: contains value: example-value search_from: 0 search_to: 100 sort: field: example-field keyword: asc responses: '200': description: Attack surface incidents returned successfully. content: application/json: schema: type: object properties: reply: type: object properties: total_count: type: integer result_count: type: integer incidents: type: array items: $ref: '#/components/schemas/AsmIncident' examples: GetIncidents200Example: summary: Default getIncidents 200 response x-microcks-default: true value: reply: total_count: 723 result_count: 282 incidents: - incident_id: '593269' incident_name: Production Agent 40 status: resolved_no_risk severity: informational incident_type: &id001 - standard assigned_user_mail: analyst1@example.com assigned_user_pretty_name: John Smith alert_count: 939 description: Alert threat detected Security incident monitoring activity incident. creation_time: 1704469877477 modification_time: 1740534005374 resolved_by: example-resolved_by resolve_comment: Rule on firewall violation traffic violation Security detected. tags: &id002 - key: example-key value: example-value - incident_id: '593269' incident_name: Production Agent 40 status: resolved_no_risk severity: informational incident_type: *id001 assigned_user_mail: analyst1@example.com assigned_user_pretty_name: John Smith alert_count: 939 description: Alert threat detected Security incident monitoring activity incident. creation_time: 1704469877477 modification_time: 1740534005374 resolved_by: example-resolved_by resolve_comment: Rule on firewall violation traffic violation Security detected. tags: *id002 '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden_2' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incident_management/update_incident: post: operationId: updateIncident summary: Palo Alto Networks Update Attack Surface Incident description: Updates the status, assignee, severity, or resolution details of an attack surface incident. Use this endpoint to track remediation progress and close incidents after the exposure has been addressed. tags: - Incidents requestBody: required: true content: application/json: schema: type: object required: - request_data properties: request_data: type: object required: - incident_id properties: incident_id: type: string description: Unique identifier of the attack surface incident. status: type: string enum: - new - under_investigation - resolved - resolved_no_risk - resolved_risk_accepted - resolved_contested_asset - resolved_remediated_automatically assigned_user_mail: type: string description: Email of the user to assign the incident to. assigned_user_pretty_name: type: string severity: type: string enum: - critical - high - medium - low - informational resolve_comment: type: string description: Resolution comment when closing an incident. comment: type: string description: Comment to add to the incident. examples: UpdateIncidentRequestExample: summary: Default updateIncident request x-microcks-default: true value: request_data: incident_id: '742866' status: resolved_no_risk assigned_user_mail: analyst1@example.com assigned_user_pretty_name: John Kumar severity: low resolve_comment: Endpoint incident malware on configured on incident policy endpoint. comment: Security incident rule malware suspicious detected incident traffic violation configured. responses: '200': description: Attack surface incident updated successfully. content: application/json: schema: type: object properties: reply: type: boolean examples: UpdateIncident200Example: summary: Default updateIncident 200 response x-microcks-default: true value: reply: true '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incident: post: operationId: createIncident summary: Palo Alto Networks Create Incident description: Creates a new incident in Cortex XSOAR. Incidents represent security events requiring investigation and response. Specify the incident type, severity, name, and any custom fields defined for the incident type. If an associated playbook is configured for the incident type, it starts automatically. tags: - Incidents requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateIncidentRequest' examples: CreateIncidentRequestExample: summary: Default createIncident request x-microcks-default: true value: name: Corporate Gateway 34 type: custom severity: 2 owner: example-owner occurred: '2025-12-19T01:48:14Z' details: Traffic rule network firewall endpoint incident network incident configured firewall activity. labels: - type: advanced value: example-value createInvestigation: true CustomFields: {} rawJson: example-rawJson responses: '200': description: Incident created successfully. content: application/json: schema: $ref: '#/components/schemas/Incident_3' examples: CreateIncident200Example: summary: Default createIncident 200 response x-microcks-default: true value: id: example-id name: Branch Firewall 02 type: custom status: 2 severity: 5 owner: example-owner created: '2026-04-27T13:10:38Z' modified: '2026-02-28T09:07:32Z' occurred: '2026-07-07T08:02:17Z' closed: '2025-06-22T23:38:50Z' closeReason: example-closeReason closeNotes: Malware firewall on activity applied investigation suspicious detected activity. labels: - type: custom value: example-value details: Suspicious firewall detected configured suspicious network detected blocked suspicious. investigationId: '720788' playbookId: '265379' sourceInstance: example-sourceInstance sourceBrand: example-sourceBrand rawJson: example-rawJson CustomFields: {} '400': $ref: '#/components/responses/BadRequest_2' '401': $ref: '#/components/responses/Unauthorized_2' '500': $ref: '#/components/responses/InternalServerError' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incidents/search: get: operationId: searchIncidentsGet summary: Palo Alto Networks Search Incidents (GET) description: Returns incidents matching query criteria specified as URL query parameters. Supports filtering by keyword, status, severity, type, and time range. For complex queries use POST /incidents/search. tags: - Incidents parameters: - name: query in: query description: Lucene query string to filter incidents (e.g., status:Active AND severity:High). schema: type: string example: example-query - name: size in: query description: Maximum number of incidents to return. schema: type: integer default: 10 maximum: 100 example: 10 - name: fromdate in: query description: Filter incidents created after this date (ISO 8601 format). schema: type: string format: date-time example: '2025-09-17T20:14:07Z' - name: todate in: query description: Filter incidents created before this date (ISO 8601 format). schema: type: string format: date-time example: '2025-05-07T00:33:09Z' - name: page in: query description: Page number for pagination (zero-based). schema: type: integer default: 0 example: 0 responses: '200': description: Incidents returned successfully. content: application/json: schema: $ref: '#/components/schemas/IncidentSearchResponse' examples: SearchIncidentsGet200Example: summary: Default searchIncidentsGet 200 response x-microcks-default: true value: total: value: 316 relation: example-relation incidents: - id: example-id name: Branch Firewall 02 type: custom status: 2 severity: 5 owner: example-owner created: '2026-04-27T13:10:38Z' modified: '2026-02-28T09:07:32Z' occurred: '2026-07-07T08:02:17Z' closed: '2025-06-22T23:38:50Z' closeReason: example-closeReason closeNotes: Malware firewall on activity applied investigation suspicious detected activity. labels: - type: custom value: example-value details: Suspicious firewall detected configured suspicious network detected blocked suspicious. investigationId: '720788' playbookId: '265379' sourceInstance: example-sourceInstance sourceBrand: example-sourceBrand rawJson: example-rawJson CustomFields: {} searchResultTotal: 847 '400': $ref: '#/components/responses/BadRequest_2' '401': $ref: '#/components/responses/Unauthorized_2' x-microcks-operation: delay: 0 dispatcher: FALLBACK post: operationId: searchIncidentsPost summary: Palo Alto Networks Search Incidents (POST) description: Searches for incidents using a structured filter in the request body. Supports advanced filtering, field selection, sorting, and pagination. Preferred over GET for complex queries. tags: - Incidents requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/IncidentSearchRequest' examples: SearchIncidentsPostRequestExample: summary: Default searchIncidentsPost request x-microcks-default: true value: filter: query: example-query status: - 427 sort: - field: example-field asc: true period: byFrom: '2026-11-24T23:01:39Z' byTo: '2025-06-05T03:13:28Z' fromDate: '2025-04-24T04:56:15Z' toDate: '2024-07-10T05:59:35Z' size: 10 page: 0 responses: '200': description: Incidents returned successfully. content: application/json: schema: $ref: '#/components/schemas/IncidentSearchResponse' examples: SearchIncidentsPost200Example: summary: Default searchIncidentsPost 200 response x-microcks-default: true value: total: value: 316 relation: example-relation incidents: - id: example-id name: Branch Firewall 02 type: custom status: 2 severity: 5 owner: example-owner created: '2026-04-27T13:10:38Z' modified: '2026-02-28T09:07:32Z' occurred: '2026-07-07T08:02:17Z' closed: '2025-06-22T23:38:50Z' closeReason: example-closeReason closeNotes: Malware firewall on activity applied investigation suspicious detected activity. labels: - type: custom value: example-value details: Suspicious firewall detected configured suspicious network detected blocked suspicious. investigationId: '720788' playbookId: '265379' sourceInstance: example-sourceInstance sourceBrand: example-sourceBrand rawJson: example-rawJson CustomFields: {} searchResultTotal: 847 '400': $ref: '#/components/responses/BadRequest_2' '401': $ref: '#/components/responses/Unauthorized_2' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incident/{id}: get: operationId: getIncident summary: Palo Alto Networks Get Incident description: Returns a specific incident by its unique identifier, including all fields and metadata. tags: - Incidents parameters: - $ref: '#/components/parameters/incidentId' responses: '200': description: Incident returned successfully. content: application/json: schema: $ref: '#/components/schemas/Incident_3' examples: GetIncident200Example: summary: Default getIncident 200 response x-microcks-default: true value: id: example-id name: Branch Firewall 02 type: custom status: 2 severity: 5 owner: example-owner created: '2026-04-27T13:10:38Z' modified: '2026-02-28T09:07:32Z' occurred: '2026-07-07T08:02:17Z' closed: '2025-06-22T23:38:50Z' closeReason: example-closeReason closeNotes: Malware firewall on activity applied investigation suspicious detected activity. labels: - type: custom value: example-value details: Suspicious firewall detected configured suspicious network detected blocked suspicious. investigationId: '720788' playbookId: '265379' sourceInstance: example-sourceInstance sourceBrand: example-sourceBrand rawJson: example-rawJson CustomFields: {} '401': $ref: '#/components/responses/Unauthorized_2' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incident/update: post: operationId: updateIncident summary: Palo Alto Networks Update Incident description: Updates one or more fields of an existing incident. Only the fields provided in the request body are modified. Supports updating status, severity, owner, labels, and custom fields. tags: - Incidents requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateIncidentRequest' examples: UpdateIncidentRequestExample: summary: Default updateIncident request x-microcks-default: true value: id: example-id version: 134 status: 2 severity: 3 owner: example-owner details: Threat detected violation endpoint investigation traffic policy policy activity. closeReason: example-closeReason closeNotes: Rule endpoint activity detected violation malware alert on violation threat. CustomFields: {} responses: '200': description: Incident updated successfully. content: application/json: schema: $ref: '#/components/schemas/Incident_3' examples: UpdateIncident200Example: summary: Default updateIncident 200 response x-microcks-default: true value: id: example-id name: Branch Firewall 02 type: custom status: 2 severity: 5 owner: example-owner created: '2026-04-27T13:10:38Z' modified: '2026-02-28T09:07:32Z' occurred: '2026-07-07T08:02:17Z' closed: '2025-06-22T23:38:50Z' closeReason: example-closeReason closeNotes: Malware firewall on activity applied investigation suspicious detected activity. labels: - type: custom value: example-value details: Suspicious firewall detected configured suspicious network detected blocked suspicious. investigationId: '720788' playbookId: '265379' sourceInstance: example-sourceInstance sourceBrand: example-sourceBrand rawJson: example-rawJson CustomFields: {} '400': $ref: '#/components/responses/BadRequest_2' '401': $ref: '#/components/responses/Unauthorized_2' '404': $ref: '#/components/responses/NotFound' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incidents: get: operationId: listIncidents summary: Palo Alto Networks List DLP Incidents description: Returns a paginated list of DLP incidents detected across monitored channels. Supports filtering by status, severity, and time range. Each incident represents a detected occurrence of sensitive data matching one or more configured data patterns. tags: - Incidents parameters: - name: offset in: query description: Pagination offset. schema: type: integer default: 0 example: 0 - name: limit in: query description: Maximum number of incidents to return. schema: type: integer default: 100 maximum: 500 example: 100 - name: status in: query description: Filter incidents by current status. schema: type: string enum: - open - in_review - resolved - dismissed example: in_review - name: severity in: query description: Filter incidents by severity level. schema: type: string enum: - critical - high - medium - low - informational example: high - name: start_time in: query description: Start of time range filter (ISO 8601 format). schema: type: string format: date-time example: '2025-09-06T05:58:22Z' - name: end_time in: query description: End of time range filter (ISO 8601 format). schema: type: string format: date-time example: '2026-07-24T12:34:37Z' responses: '200': description: DLP incidents returned successfully. content: application/json: schema: type: object properties: total: type: integer description: Total number of incidents matching the query. offset: type: integer limit: type: integer incidents: type: array items: $ref: '#/components/schemas/DLPIncident' examples: ListIncidents200Example: summary: Default listIncidents 200 response x-microcks-default: true value: total: 255 offset: 655 limit: 245 incidents: - incident_id: '579842' status: in_review severity: high data_pattern_name: Staging Policy 73 data_pattern_id: '449438' match_count: 11 channel: email user: example-user timestamp: '2025-04-23T07:16:37Z' application: web-browsing file_name: Corporate Gateway 41 file_type: standard file_size: 130 direction: internal action_taken: block reviewer_comments: Traffic violation blocked endpoint suspicious alert. reviewed_by: example-reviewed_by reviewed_at: '2026-03-28T05:36:16Z' - incident_id: '579842' status: in_review severity: high data_pattern_name: Staging Policy 73 data_pattern_id: '449438' match_count: 11 channel: email user: example-user timestamp: '2025-04-23T07:16:37Z' application: web-browsing file_name: Corporate Gateway 41 file_type: standard file_size: 130 direction: internal action_taken: block reviewer_comments: Traffic violation blocked endpoint suspicious alert. reviewed_by: example-reviewed_by reviewed_at: '2026-03-28T05:36:16Z' '400': $ref: '#/components/responses/BadRequest_3' '401': $ref: '#/components/responses/Unauthorized_3' '403': $ref: '#/components/responses/Forbidden_3' '500': $ref: '#/components/responses/InternalServerError_2' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incidents/{incident_id}: get: operationId: getIncident summary: Palo Alto Networks Get DLP Incident by ID description: Returns detailed information for a specific DLP incident including the full data pattern match context, affected file or transaction metadata, user attribution, and remediation history. tags: - Incidents parameters: - name: incident_id in: path required: true description: Unique incident identifier. schema: type: string example: '622134' responses: '200': description: DLP incident details returned successfully. content: application/json: schema: $ref: '#/components/schemas/DLPIncident' examples: GetIncident200Example: summary: Default getIncident 200 response x-microcks-default: true value: incident_id: '579842' status: in_review severity: high data_pattern_name: Staging Policy 73 data_pattern_id: '449438' match_count: 11 channel: email user: example-user timestamp: '2025-04-23T07:16:37Z' application: web-browsing file_name: Corporate Gateway 41 file_type: standard file_size: 130 direction: internal action_taken: block reviewer_comments: Traffic violation blocked endpoint suspicious alert. reviewed_by: example-reviewed_by reviewed_at: '2026-03-28T05:36:16Z' '401': $ref: '#/components/responses/Unauthorized_3' '403': $ref: '#/components/responses/Forbidden_3' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError_2' x-microcks-operation: delay: 0 dispatcher: FALLBACK put: operationId: updateIncident summary: Palo Alto Networks Update DLP Incident description: Updates the status or reviewer comments for a specific DLP incident. Used to progress incidents through the investigation workflow and to document review findings. tags: - Incidents parameters: - name: incident_id in: path required: true description: Unique incident identifier. schema: type: string example: '329414' requestBody: required: true content: application/json: schema: type: object properties: status: type: string enum: - open - in_review - resolved - dismissed description: New status for the incident. reviewer_comments: type: string description: Comments from the reviewing analyst. examples: UpdateIncidentRequestExample: summary: Default updateIncident request x-microcks-default: true value: status: in_review reviewer_comments: Alert investigation violation detected applied policy incident activity. responses: '200': description: Incident updated successfully. content: application/json: schema: $ref: '#/components/schemas/DLPIncident' examples: UpdateIncident200Example: summary: Default updateIncident 200 response x-microcks-default: true value: incident_id: '579842' status: in_review severity: high data_pattern_name: Staging Policy 73 data_pattern_id: '449438' match_count: 11 channel: email user: example-user timestamp: '2025-04-23T07:16:37Z' application: web-browsing file_name: Corporate Gateway 41 file_type: standard file_size: 130 direction: internal action_taken: block reviewer_comments: Traffic violation blocked endpoint suspicious alert. reviewed_by: example-reviewed_by reviewed_at: '2026-03-28T05:36:16Z' '400': $ref: '#/components/responses/BadRequest_3' '401': $ref: '#/components/responses/Unauthorized_3' '403': $ref: '#/components/responses/Forbidden_3' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError_2' x-microcks-operation: delay: 0 dispatcher: FALLBACK /incidents/{incident_id}/snippets: get: operationId: getIncidentSnippets summary: Palo Alto Networks Get Incident Content Snippets description: Returns content snippets showing the context around data pattern matches in the incident. Snippets provide visibility into the sensitive data that triggered the DLP policy without returning the full document or transaction content. Matched values are partially masked by default. tags: - Incidents parameters: - name: incident_id in: path required: true description: Unique incident identifier. schema: type: string example: '142519' responses: '200': description: Content snippets returned successfully. content: application/json: schema: type: object properties: incident_id: type: string description: Identifier of the parent incident. snippets: type: array items: $ref: '#/components/schemas/ContentSnippet' examples: GetIncidentSnippets200Example: summary: Default getIncidentSnippets 200 response x-microcks-default: true value: incident_id: '366469' snippets: - pattern_id: '324297' pattern_name: Primary Firewall 23 snippet: example-snippet position: 604 masked: true - pattern_id: '324297' pattern_name: Primary Firewall 23 snippet: example-snippet position: 604 masked: true '401': $ref: '#/components/responses/Unauthorized_3' '403': $ref: '#/components/responses/Forbidden_3' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError_2' x-microcks-operation: delay: 0 dispatcher: FALLBACK /email-incidents: get: operationId: listEmailIncidents summary: Palo Alto Networks List Email Incidents description: Returns a paginated list of email DLP incidents where sensitive data was detected in email messages or attachments. Supports filtering by status, time range, and pagination. Each incident represents a single email message that triggered one or more data pattern matches. tags: - Incidents parameters: - name: offset in: query description: Pagination offset. schema: type: integer default: 0 example: 0 - name: limit in: query description: Maximum number of incidents to return. schema: type: integer default: 100 maximum: 500 example: 100 - name: status in: query description: Filter incidents by current status. schema: type: string enum: - pending - allowed - blocked - quarantined example: pending - name: start_time in: query description: Start of time range filter (ISO 8601 format). schema: type: string format: date-time example: '2025-03-04T07:46:01Z' - name: end_time in: query description: End of time range filter (ISO 8601 format). schema: type: string format: date-time example: '2024-04-23T13:33:45Z' responses: '200': description: Email DLP incidents returned successfully. content: application/json: schema: type: object properties: total: type: integer description: Total number of incidents matching the query. offset: type: integer limit: type: integer incidents: type: array items: $ref: '#/components/schemas/EmailDLPIncident' examples: ListEmailIncidents200Example: summary: Default listEmailIncidents 200 response x-microcks-default: true value: total: 952 offset: 886 limit: 211 incidents: - id: example-id sender: example-sender subject: example-subject status: quarantined severity: high data_patterns: &id003 - id: example-id name: Corporate Gateway 08 category: advanced match_count: 213 - id: example-id name: Branch Firewall 50 category: custom match_count: 866 match_count: 977 timestamp: '2026-05-12T04:25:43Z' has_attachments: true attachment_count: 524 direction: inbound action_taken: block reviewed_by: example-reviewed_by reviewed_at: '2026-08-04T23:58:33Z' comment: Alert investigation configured detected investigation network network threat. - id: example-id sender: example-sender subject: example-subject status: quarantined severity: high data_patterns: *id003 match_count: 977 timestamp: '2026-05-12T04:25:43Z' has_attachments: true attachment_count: 524 direction: inbound action_taken: block reviewed_by: example-reviewed_by reviewed_at: '2026-08-04T23:58:33Z' comment: Alert investigation configured detected investigation network network threat. '400': $ref: '#/components/responses/BadRequest_4' '401': $ref: '#/components/responses/Unauthorized_4' '403': $ref: '#/components/responses/Forbidden_4' '500': $ref: '#/components/responses/InternalServerError_3' x-microcks-operation: delay: 0 dispatcher: FALLBACK /email-incidents/{id}: get: operationId: getEmailIncident summary: Palo Alto Networks Get Email Incident Details description: Returns detailed information for a specific email DLP incident including sender, recipients, subject, verdict, and data pattern matches. Provides full incident context for investigation and triage. tags: - Incidents parameters: - name: id in: path required: true description: Unique incident identifier. schema: type: string example: example-id responses: '200': description: Email DLP incident returned successfully. content: application/json: schema: $ref: '#/components/schemas/EmailDLPIncident' examples: GetEmailIncident200Example: summary: Default getEmailIncident 200 response x-microcks-default: true value: id: example-id sender: example-sender subject: example-subject status: quarantined severity: high data_patterns: - id: example-id name: Corporate Gateway 08 category: advanced match_count: 213 - id: example-id name: Branch Firewall 50 category: custom match_count: 866 match_count: 977 timestamp: '2026-05-12T04:25:43Z' has_attachments: true attachment_count: 524 direction: inbound action_taken: block reviewed_by: example-reviewed_by reviewed_at: '2026-08-04T23:58:33Z' comment: Alert investigation configured detected investigation network network threat. '401': $ref: '#/components/responses/Unauthorized_4' '403': $ref: '#/components/responses/Forbidden_4' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError_3' x-microcks-operation: delay: 0 dispatcher: FALLBACK /email-incidents/{id}/verdict: put: operationId: updateEmailIncidentVerdict summary: Palo Alto Networks Update Email Incident Verdict description: Updates the verdict for a specific email DLP incident. Allows security analysts to override the automated verdict by approving blocked messages (allow) or blocking previously allowed messages (block). Supports adding a comment to document the decision. tags: - Incidents parameters: - name: id in: path required: true description: Unique incident identifier. schema: type: string example: example-id requestBody: required: true content: application/json: schema: type: object required: - verdict properties: verdict: type: string enum: - allow - block description: New verdict for the email message. Setting to allow releases a quarantined or blocked message for delivery. Setting to block prevents delivery of a pending message. comment: type: string description: Comment explaining the verdict decision. examples: UpdateEmailIncidentVerdictRequestExample: summary: Default updateEmailIncidentVerdict request x-microcks-default: true value: verdict: allow comment: Firewall suspicious endpoint alert policy traffic. responses: '200': description: Verdict updated successfully. content: application/json: schema: type: object properties: success: type: boolean description: Whether the update was successful. incident: $ref: '#/components/schemas/EmailDLPIncident' examples: UpdateEmailIncidentVerdict200Example: summary: Default updateEmailIncidentVerdict 200 response x-microcks-default: true value: success: false incident: id: example-id sender: example-sender subject: example-subject status: quarantined severity: high data_patterns: - id: example-id name: Corporate Gateway 08 category: advanced match_count: 213 - id: example-id name: Branch Firewall 50 category: custom match_count: 866 match_count: 977 timestamp: '2026-05-12T04:25:43Z' has_attachments: true attachment_count: 524 direction: inbound action_taken: block reviewed_by: example-reviewed_by reviewed_at: '2026-08-04T23:58:33Z' comment: Alert investigation configured detected investigation network network threat. '400': $ref: '#/components/responses/BadRequest_4' '401': $ref: '#/components/responses/Unauthorized_4' '403': $ref: '#/components/responses/Forbidden_4' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError_3' x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/incidents: get: operationId: listIncidents summary: Palo Alto Networks List Incidents description: Returns a paginated list of security incidents detected across connected SaaS applications. Supports filtering by status, severity, application, and date range. Incidents represent policy violations or anomalous activity such as external sharing of sensitive data, malware uploads, or configuration violations. tags: - Incidents parameters: - name: offset in: query description: Number of results to skip for pagination. schema: type: integer default: 0 example: 0 - name: limit in: query description: Maximum number of incidents to return per page. schema: type: integer default: 50 maximum: 200 example: 50 - name: status in: query description: Filter incidents by current status. schema: type: string enum: - new - in_progress - resolved - dismissed example: resolved - name: severity in: query description: Filter incidents by severity level. schema: type: string enum: - low - medium - high - critical example: low - name: app_id in: query description: Filter incidents by SaaS application ID. schema: type: string example: '490106' - name: start_date in: query description: Filter incidents created on or after this date (ISO 8601). schema: type: string format: date-time example: '2025-11-22T11:53:29Z' - name: end_date in: query description: Filter incidents created on or before this date (ISO 8601). schema: type: string format: date-time example: '2024-08-28T03:48:57Z' responses: '200': description: Incidents returned. content: application/json: schema: type: object properties: total: type: integer description: Total number of incidents matching the query. offset: type: integer limit: type: integer items: type: array items: $ref: '#/components/schemas/Incident_4' examples: ListIncidents200Example: summary: Default listIncidents 200 response x-microcks-default: true value: total: 706 offset: 152 limit: 817 items: - id: example-id title: Primary Agent 47 description: Investigation incident suspicious policy on applied alert endpoint traffic endpoint blocked violation. status: resolved severity: critical app_id: '781451' app_name: Staging Agent 76 policy_name: Branch Sensor 98 affected_assets: &id004 - example-affected_assets_item - example-affected_assets_item affected_users: &id005 - example-affected_users_item assignee_id: '140527' created_at: '2026-06-24T16:04:21Z' updated_at: '2024-02-19T07:50:40Z' - id: example-id title: Primary Agent 47 description: Investigation incident suspicious policy on applied alert endpoint traffic endpoint blocked violation. status: resolved severity: critical app_id: '781451' app_name: Staging Agent 76 policy_name: Branch Sensor 98 affected_assets: *id004 affected_users: *id005 assignee_id: '140527' created_at: '2026-06-24T16:04:21Z' updated_at: '2024-02-19T07:50:40Z' '400': description: Invalid query parameters. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: ListIncidents400Example: summary: Default listIncidents 400 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 '401': description: Invalid or missing Bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: ListIncidents401Example: summary: Default listIncidents 401 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 '403': description: Insufficient permissions. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: ListIncidents403Example: summary: Default listIncidents 403 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: ListIncidents500Example: summary: Default listIncidents 500 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/incidents/{id}: get: operationId: getIncident summary: Palo Alto Networks Get Incident Details description: Returns complete details for a specific security incident including the affected assets, impacted users, policy violations triggered, timeline of events, and current remediation status. tags: - Incidents parameters: - name: id in: path required: true description: Unique identifier of the incident. schema: type: string example: example-id responses: '200': description: Incident details returned. content: application/json: schema: $ref: '#/components/schemas/Incident_4' examples: GetIncident200Example: summary: Default getIncident 200 response x-microcks-default: true value: id: example-id title: Primary Agent 47 description: Investigation incident suspicious policy on applied alert endpoint traffic endpoint blocked violation. status: resolved severity: critical app_id: '781451' app_name: Staging Agent 76 policy_name: Branch Sensor 98 affected_assets: - example-affected_assets_item - example-affected_assets_item affected_users: - example-affected_users_item assignee_id: '140527' created_at: '2026-06-24T16:04:21Z' updated_at: '2024-02-19T07:50:40Z' '401': description: Invalid or missing Bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: GetIncident401Example: summary: Default getIncident 401 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 '403': description: Insufficient permissions. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: GetIncident403Example: summary: Default getIncident 403 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 '404': description: Incident not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: GetIncident404Example: summary: Default getIncident 404 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: GetIncident500Example: summary: Default getIncident 500 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 x-microcks-operation: delay: 0 dispatcher: FALLBACK put: operationId: updateIncident summary: Palo Alto Networks Update Incident description: Updates the status, assignee, or adds a note to an existing security incident. Use this endpoint to integrate SaaS Security into incident response workflows and SOAR playbooks. tags: - Incidents parameters: - name: id in: path required: true description: Unique identifier of the incident to update. schema: type: string example: example-id requestBody: required: true content: application/json: schema: type: object properties: status: type: string enum: - new - in_progress - resolved - dismissed description: New status for the incident. assignee_id: type: string description: User ID to assign the incident to. note: type: string description: Text note to add to the incident timeline. maxLength: 4096 examples: UpdateIncidentRequestExample: summary: Default updateIncident request x-microcks-default: true value: status: in_progress assignee_id: '685364' note: example-note responses: '200': description: Incident updated successfully. content: application/json: schema: $ref: '#/components/schemas/Incident_4' examples: UpdateIncident200Example: summary: Default updateIncident 200 response x-microcks-default: true value: id: example-id title: Primary Agent 47 description: Investigation incident suspicious policy on applied alert endpoint traffic endpoint blocked violation. status: resolved severity: critical app_id: '781451' app_name: Staging Agent 76 policy_name: Branch Sensor 98 affected_assets: - example-affected_assets_item - example-affected_assets_item affected_users: - example-affected_users_item assignee_id: '140527' created_at: '2026-06-24T16:04:21Z' updated_at: '2024-02-19T07:50:40Z' '400': description: Invalid request body. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: UpdateIncident400Example: summary: Default updateIncident 400 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 '401': description: Invalid or missing Bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: UpdateIncident401Example: summary: Default updateIncident 401 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 '403': description: Insufficient permissions. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: UpdateIncident403Example: summary: Default updateIncident 403 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 '404': description: Incident not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: UpdateIncident404Example: summary: Default updateIncident 404 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_7' examples: UpdateIncident500Example: summary: Default updateIncident 500 response x-microcks-default: true value: error: example-error message: Configured monitoring network blocked investigation applied activity. request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60 x-microcks-operation: delay: 0 dispatcher: FALLBACK components: responses: Forbidden_4: description: Insufficient role permissions for this operation. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_6' BadRequest_2: description: Malformed request or invalid parameters. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_4' NotFound: description: The requested resource was not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalServerError_2: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_5' Forbidden_2: description: Insufficient RBAC permissions for the requested operation. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_2' BadRequest_3: description: Invalid request parameters or body. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_5' Unauthorized_3: description: Invalid or expired bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_5' InternalServerError_3: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_6' Unauthorized_2: description: Missing or invalid API key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_4' InternalServerError: description: An internal server error occurred. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden_3: description: Insufficient permissions for this operation. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_5' Unauthorized_4: description: Invalid or expired bearer token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_6' Forbidden: description: Insufficient permissions for the requested operation. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid authentication headers. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' BadRequest_4: description: Invalid request parameters or body. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse_6' BadRequest: description: Malformed request body or invalid parameters. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' parameters: incidentId: name: id in: path required: true description: Unique identifier of the incident. schema: type: string schemas: ErrorResponse: type: object properties: reply: type: object properties: err_code: type: integer example: 782 err_msg: type: string example: example-err_msg err_extra: type: string example: example-err_extra example: err_code: 270 err_msg: example-err_msg err_extra: example-err_extra SortOrder_2: type: object description: Sorting specification for result sets. properties: field: type: string example: example-field keyword: type: string enum: - asc - desc example: asc UpdateIncidentRequest: type: object required: - id properties: id: type: string description: ID of the incident to update. example: example-id version: type: integer description: Incident version for optimistic locking. Retrieve from a prior GET request. example: 134 status: type: integer enum: - 0 - 1 - 2 - 3 example: 2 severity: type: integer enum: - 0 - 1 - 2 - 3 - 4 - 5 example: 3 owner: type: string example: example-owner details: type: string example: Threat detected violation endpoint investigation traffic policy policy activity. closeReason: type: string example: example-closeReason closeNotes: type: string example: Rule endpoint activity detected violation malware alert on violation threat. CustomFields: type: object additionalProperties: true example: {} IncidentSearchResponse: type: object properties: total: type: object properties: value: type: integer example: 915 relation: type: string example: example-relation example: value: 316 relation: example-relation incidents: type: array items: $ref: '#/components/schemas/Incident_3' example: - id: example-id name: Branch Firewall 02 type: custom status: 2 severity: 5 owner: example-owner created: '2026-04-27T13:10:38Z' modified: '2026-02-28T09:07:32Z' occurred: '2026-07-07T08:02:17Z' closed: '2025-06-22T23:38:50Z' closeReason: example-closeReason closeNotes: Malware firewall on activity applied investigation suspicious detected activity. labels: - type: custom value: example-value details: Suspicious firewall detected configured suspicious network detected blocked suspicious. investigationId: '720788' playbookId: '265379' sourceInstance: example-sourceInstance sourceBrand: example-sourceBrand rawJson: example-rawJson CustomFields: {} searchResultTotal: type: integer example: 847 CreateIncidentRequest: type: object required: - name properties: name: type: string description: Incident name. example: Corporate Gateway 34 type: type: string description: Incident type name. example: custom severity: type: integer enum: - 0 - 1 - 2 - 3 - 4 - 5 example: 2 owner: type: string example: example-owner occurred: type: string format: date-time example: '2025-12-19T01:48:14Z' details: type: string example: Traffic rule network firewall endpoint incident network incident configured firewall activity. labels: type: array items: type: object properties: type: type: string example: advanced value: type: string example: example-value example: - type: advanced value: example-value createInvestigation: type: boolean default: true description: Whether to automatically create an investigation for this incident. example: true CustomFields: type: object additionalProperties: true example: {} rawJson: type: string example: example-rawJson Filter: type: object description: A filter criterion for querying XDR resources. required: - field - operator - value properties: field: type: string description: Field name to filter on (e.g., incident_id, status, severity). example: example-field operator: type: string enum: - in - contains - gte - lte - eq - neq description: Comparison operator. example: lte value: description: Filter value. Use an array for the "in" operator, a string or integer for others. oneOf: - type: string - type: integer - type: array items: oneOf: - type: string - type: integer example: example-value Incident: type: object description: A Cortex XDR incident grouping related alerts. properties: incident_id: type: string example: '877543' incident_name: type: string example: Branch Gateway 82 description: type: string example: Firewall traffic applied alert threat blocked Security rule. status: type: string enum: - new - under_investigation - resolved_threat_handled - resolved_known_issue - resolved_duplicate - resolved_false_positive - resolved_other example: resolved_threat_handled severity: type: string enum: - critical - high - medium - low - informational - unknown example: informational assigned_user_mail: type: string example: analyst1@example.com assigned_user_pretty_name: type: string example: Carlos Smith alert_count: type: integer example: 509 low_severity_alert_count: type: integer example: 929 med_severity_alert_count: type: integer example: 295 high_severity_alert_count: type: integer example: 602 critical_severity_alert_count: type: integer example: 936 user_count: type: integer example: 170 host_count: type: integer example: 720 creation_time: type: integer description: Incident creation timestamp as Unix epoch milliseconds. example: 1707012665747 modification_time: type: integer description: Last modification timestamp as Unix epoch milliseconds. example: 1744706901976 detection_time: type: integer example: 1704757310414 starred: type: boolean example: true xdr_url: type: string description: Direct URL to the incident in the XDR console. example: https://portal.acme-systems.org/0455da rule_based_score: type: integer example: 942 manual_score: type: integer example: 174 IncidentDetail: allOf: - $ref: '#/components/schemas/Incident' - type: object properties: network_artifacts: type: object file_artifacts: type: object hosts: type: array items: type: string users: type: array items: type: string incident_sources: type: array items: type: string mitre_tactics_ids_and_names: type: array items: type: string mitre_techniques_ids_and_names: type: array items: type: string ErrorResponse_6: type: object properties: error: type: string description: Error code or type. example: example-error message: type: string description: Human-readable error message. example: Policy network malware on detected configured on incident blocked violation. SortOrder: type: object description: Sorting specification for result sets. properties: field: type: string description: Field to sort by. example: example-field keyword: type: string enum: - asc - desc description: Sort direction. example: asc EmailDLPIncident: type: object properties: id: type: string description: Unique incident identifier. example: example-id sender: type: string description: Email address of the message sender. example: example-sender subject: type: string description: Email message subject line. example: example-subject status: type: string enum: - pending - allowed - blocked - quarantined description: Current status or verdict for the email message. example: quarantined severity: type: string enum: - critical - high - medium - low - informational description: Incident severity based on data pattern sensitivity. example: high data_patterns: type: array items: type: object properties: id: type: string example: example-id name: type: string example: Primary Agent 95 category: type: string example: advanced match_count: type: integer example: 353 description: Data patterns that matched in the email content. example: - id: example-id name: Corporate Gateway 08 category: advanced match_count: 213 - id: example-id name: Branch Firewall 50 category: custom match_count: 866 match_count: type: integer description: Total number of data pattern matches across all patterns. example: 977 timestamp: type: string format: date-time description: Timestamp when the incident was detected. example: '2026-05-12T04:25:43Z' has_attachments: type: boolean description: Whether the email contained attachments. example: true attachment_count: type: integer description: Number of attachments in the email. example: 524 direction: type: string enum: - inbound - outbound - internal description: Direction of the email message. example: inbound action_taken: type: string enum: - alert - block - quarantine description: Automated action taken on the message. example: block reviewed_by: type: string description: Email address of the analyst who reviewed the incident. example: example-reviewed_by reviewed_at: type: string format: date-time description: Timestamp when the incident was last reviewed. example: '2026-08-04T23:58:33Z' comment: type: string description: Comment added during verdict review. example: Alert investigation configured detected investigation network network threat. Alert: type: object description: A Cortex XDR alert representing a single detection event. properties: alert_id: type: string example: '999423' detection_timestamp: type: integer description: Detection timestamp as Unix epoch milliseconds. example: 1733555086833 name: type: string description: Alert name or rule name that triggered this alert. example: Staging Policy 70 category: type: string description: Alert category (e.g., Malware, Exploit, Lateral Movement). example: custom description: type: string example: Rule incident incident firewall suspicious monitoring activity threat rule monitoring suspicious detected. host_ip: type: array items: type: string example: - example-host_ip_item - example-host_ip_item host_name: type: string example: Corporate Agent 14 user_name: type: string example: jsmith mac: type: array items: type: string example: - example-mac_item source: type: string description: Data source that generated the alert. example: example-source action: type: string description: Action taken on the alert. example: alert action_pretty: type: string example: alert severity: type: string enum: - critical - high - medium - low - informational - unknown example: informational matching_status: type: string example: running alert_type: type: string example: standard resolution_status: type: string example: enabled resolution_comment: type: string example: Monitoring threat applied Security investigation Security configured. Filter_2: type: object description: A filter criterion for querying Xpanse resources. required: - field - operator - value properties: field: type: string description: Field name to filter on. example: example-field operator: type: string enum: - in - contains - gte - lte - eq - neq example: contains value: description: Filter value (string, integer, or array for "in" operator). oneOf: - type: string - type: integer - type: array items: oneOf: - type: string - type: integer example: example-value DLPIncident: type: object properties: incident_id: type: string description: Unique incident identifier. example: '579842' status: type: string enum: - open - in_review - resolved - dismissed description: Current incident status. example: in_review severity: type: string enum: - critical - high - medium - low - informational description: Incident severity level. example: high data_pattern_name: type: string description: Name of the data pattern that triggered the incident. example: Staging Policy 73 data_pattern_id: type: string description: Identifier of the data pattern that triggered the incident. example: '449438' match_count: type: integer description: Number of data pattern matches in the content. example: 11 channel: type: string enum: - web - ssl - saas - email - endpoint description: Channel where the data exposure was detected. example: email user: type: string description: Email address or username of the user involved. example: example-user timestamp: type: string format: date-time description: Timestamp when the incident was detected. example: '2025-04-23T07:16:37Z' application: type: string description: Application associated with the incident. example: web-browsing file_name: type: string description: Name of the file containing sensitive data. example: Corporate Gateway 41 file_type: type: string description: MIME type of the file. example: standard file_size: type: integer description: Size of the file in bytes. example: 130 direction: type: string enum: - upload - download - internal description: Direction of data movement. example: internal action_taken: type: string enum: - alert - block - quarantine - encrypt description: Automated action taken on the incident. example: block reviewer_comments: type: string description: Comments added by the reviewing analyst. example: Traffic violation blocked endpoint suspicious alert. reviewed_by: type: string description: Email address of the analyst who reviewed the incident. example: example-reviewed_by reviewed_at: type: string format: date-time description: Timestamp when the incident was last reviewed. example: '2026-03-28T05:36:16Z' AsmIncident: type: object description: An attack surface incident representing a confirmed exposure requiring remediation. properties: incident_id: type: string description: Unique attack surface incident identifier. example: '593269' incident_name: type: string example: Production Agent 40 status: type: string enum: - new - under_investigation - resolved - resolved_no_risk - resolved_risk_accepted - resolved_contested_asset - resolved_remediated_automatically example: resolved_no_risk severity: type: string enum: - critical - high - medium - low - informational example: informational incident_type: type: array items: type: string description: Attack surface rule types that triggered this incident. example: - standard assigned_user_mail: type: string example: analyst1@example.com assigned_user_pretty_name: type: string example: John Smith alert_count: type: integer example: 939 description: type: string example: Alert threat detected Security incident monitoring activity incident. creation_time: type: integer description: Incident creation timestamp as Unix epoch milliseconds. example: 1704469877477 modification_time: type: integer example: 1740534005374 resolved_by: type: string example: example-resolved_by resolve_comment: type: string example: Rule on firewall violation traffic violation Security detected. tags: type: array items: type: object properties: key: type: string example: example-key value: type: string example: example-value example: - key: example-key value: example-value Incident_4: type: object properties: id: type: string description: Unique incident identifier. example: example-id title: type: string description: Summary title of the incident. example: Primary Agent 47 description: type: string description: Detailed description of the security incident. example: Investigation incident suspicious policy on applied alert endpoint traffic endpoint blocked violation. status: type: string enum: - new - in_progress - resolved - dismissed description: Current incident status. example: resolved severity: type: string enum: - low - medium - high - critical description: Incident severity level. example: critical app_id: type: string description: ID of the SaaS application where the incident occurred. example: '781451' app_name: type: string description: Name of the SaaS application. example: Staging Agent 76 policy_name: type: string description: Name of the policy that triggered the incident. example: Branch Sensor 98 affected_assets: type: array items: type: string description: IDs of assets involved in the incident. example: - example-affected_assets_item - example-affected_assets_item affected_users: type: array items: type: string description: User IDs of users involved in the incident. example: - example-affected_users_item assignee_id: type: string description: User ID of the assigned analyst. example: '140527' created_at: type: string format: date-time description: Timestamp when the incident was detected. example: '2026-06-24T16:04:21Z' updated_at: type: string format: date-time description: Timestamp of the most recent update. example: '2024-02-19T07:50:40Z' Incident_3: type: object description: A Cortex XSOAR incident representing a security event under investigation. properties: id: type: string description: Unique incident identifier. readOnly: true example: example-id name: type: string description: Incident name or title. example: Branch Firewall 02 type: type: string description: Incident type (maps to an incident type definition). example: custom status: type: integer description: 'Incident status code: 0 (Pending), 1 (Active), 2 (Done), 3 (Archive).' enum: - 0 - 1 - 2 - 3 example: 2 severity: type: integer description: 'Severity level: 0 (Unknown), 1 (Informational), 2 (Low), 3 (Medium), 4 (High), 5 (Critical).' enum: - 0 - 1 - 2 - 3 - 4 - 5 example: 5 owner: type: string description: Username of the analyst assigned to this incident. example: example-owner created: type: string format: date-time description: Incident creation timestamp. readOnly: true example: '2026-04-27T13:10:38Z' modified: type: string format: date-time description: Last modification timestamp. readOnly: true example: '2026-02-28T09:07:32Z' occurred: type: string format: date-time description: Timestamp when the security event occurred. example: '2026-07-07T08:02:17Z' closed: type: string format: date-time description: Incident closure timestamp. example: '2025-06-22T23:38:50Z' closeReason: type: string description: Reason for closing the incident. example: example-closeReason closeNotes: type: string description: Notes added when closing the incident. example: Malware firewall on activity applied investigation suspicious detected activity. labels: type: array items: type: object properties: type: type: string example: standard value: type: string example: example-value description: Key-value label pairs attached to the incident. example: - type: custom value: example-value details: type: string description: Incident details or description. example: Suspicious firewall detected configured suspicious network detected blocked suspicious. investigationId: type: string description: Associated investigation ID. readOnly: true example: '720788' playbookId: type: string description: Playbook assigned to this incident. example: '265379' sourceInstance: type: string description: Integration instance that created this incident. example: example-sourceInstance sourceBrand: type: string description: Integration brand that created this incident. example: example-sourceBrand rawJson: type: string description: Raw JSON payload from the originating event. example: example-rawJson CustomFields: type: object description: Custom field values specific to the incident type. additionalProperties: true example: {} ContentSnippet: type: object properties: pattern_id: type: string description: Data pattern identifier that matched. example: '324297' pattern_name: type: string description: Data pattern name that matched. example: Primary Firewall 23 snippet: type: string description: Context snippet around the data pattern match. example: example-snippet position: type: integer description: Character offset position of the match within the document. example: 604 masked: type: boolean description: Whether the matched content within the snippet is masked. example: true IncidentSearchRequest: type: object properties: filter: type: object description: Structured filter criteria for the incident search. properties: query: type: string description: Lucene query string (e.g., status:Active severity:High). example: example-query status: type: array items: type: integer example: - 553 - 65 sort: type: array items: type: object properties: field: type: string example: example-field asc: type: boolean example: true example: - field: example-field asc: true period: type: object properties: byFrom: type: string format: date-time example: '2025-10-15T10:06:27Z' byTo: type: string format: date-time example: '2025-07-01T06:45:06Z' example: byFrom: '2026-06-15T05:32:46Z' byTo: '2026-02-15T17:36:40Z' example: query: example-query status: - 427 sort: - field: example-field asc: true period: byFrom: '2026-11-24T23:01:39Z' byTo: '2025-06-05T03:13:28Z' fromDate: type: string format: date-time example: '2025-04-24T04:56:15Z' toDate: type: string format: date-time example: '2024-07-10T05:59:35Z' size: type: integer default: 10 maximum: 100 example: 10 page: type: integer default: 0 example: 0 ErrorResponse_4: type: object properties: id: type: string example: example-id status: type: integer example: 19 title: type: string example: Corporate Gateway 74 detail: type: string example: example-detail error: type: string example: example-error ErrorResponse_2: type: object properties: reply: type: object properties: err_code: type: integer example: 849 err_msg: type: string example: example-err_msg err_extra: type: string example: example-err_extra example: err_code: 931 err_msg: example-err_msg err_extra: example-err_extra ErrorResponse_7: type: object properties: error: type: string description: Error code identifying the error type. example: example-error message: type: string description: Human-readable description of the error. example: Configured monitoring network blocked investigation applied activity. request_id: type: string description: Request identifier for support correlation. example: 5cc3d66e-5479-4e15-bd64-849adde3cb60 ErrorResponse_5: type: object properties: error: type: string description: Error code or type. example: example-error message: type: string description: Human-readable error message. example: Policy blocked rule alert configured traffic Security activity. securitySchemes: oauth2Bearer: type: http scheme: bearer bearerFormat: JWT description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.