Palo Alto Networks Incidents API API

openapi: 3.2.0
info:
  contact: {}
  description: "Manage and retrieve DLP incidents across v1 and v2 endpoints. This API group provides comprehensive \nincident lifecycle management including retrieval with advanced filtering, assignment management, \nnotes management, and resolution status tracking for both legacy and current API versions.\n"
  license:
    name: MIT
    url: https://opensource.org/license/mit
  title: Incidents API
  version: 1.0.0
servers:
- url: https://api.dlp.paloaltonetworks.com
tags:
- name: Incidents API
paths:
  /v1/api/incidents/assignee:
    get:
      description: "Retrieve information about all assignees in your organization. This allows you to programmatically \naccess a list of team members who can examine and manage DLP incidents.\n"
      operationId: get-v1-api-incidents-assignee
      responses:
        '200':
          content:
            application/json:
              examples:
                assignees:
                  value:
                  - createdAt: 2024-Jan-11 23:16:33 UTC
                    emailAddress: test@test.com
                    firstName: test u
                    id: 00d53ebf-c386-4b95-ad05-6819517c3450
                    lastName: test
                    status: ACTIVE
                    tenantId: '5886928188517009408'
                    updatedAt: 2024-Feb-14 19:13:01 UTC
                  - createdAt: 2023-Aug-03 21:23:39 UTC
                    emailAddress: user1@test.com
                    firstName: user
                    id: 133b9b0d-6e64-40ca-abec-15ff3b906b80
                    lastName: my last name
                    status: ACTIVE
                    tenantId: '5886928188517009408'
              schema:
                items:
                  $ref: '#/components/schemas/IncidentAssignee'
                type: array
          description: Successfully retrieved all assignees.
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - Bearer: []
      summary: Retrieve All Assignees
      tags:
      - Incidents API
    put:
      description: "Update information about assignees who can examine and manage DLP incidents. This allows you to \nprogrammatically maintain assignee details such as contact information and status.\n"
      operationId: put-v1-api-incidents-assignee
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentAssigneeDTO'
        description: Request body containing the assignee information to update.
        required: true
      responses:
        '200':
          description: Successfully updated assignee information.
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Internal server error
      security:
      - Bearer: []
      summary: Update Assignee Information
      tags:
      - Incidents API
  /v1/api/incidents/assignee/{assigneeId}:
    get:
      description: "Retrieve detailed information about a specific assignee including contact information and status. \nThis allows you to programmatically access information about team members who can examine and manage DLP incidents.\n"
      operationId: get-v1-api-incidents-assignee-assigneeid
      parameters:
      - description: The unique identifier of the assignee.
        in: path
        name: assigneeId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                assignee:
                  value:
                    createdAt: 2024-Jan-11 23:16:33 UTC
                    emailAddress: test@test.com
                    firstName: test
                    id: 00d53ebf-c386-4b95-ad05-6819517c3450
                    lastName: test
                    status: ACTIVE
                    tenantId: '5886928188517009408'
              schema:
                $ref: '#/components/schemas/IncidentAssignee'
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - Bearer: []
      summary: Retrieve Assignee Details
      tags:
      - Incidents API
  /v1/api/incidents/{incidentID}/assignee:
    put:
      description: 'Assign a DLP incident to a specific user or team member. Once assigned, the assignee can then:

        * Update incident notes

        * Update incident resolution status

        * Manage incident lifecycle

        '
      operationId: put-v1-api-incidents-incidentid-assignee
      parameters:
      - description: The geographic region of the incident (defaults to US).
        in: query
        name: region
        required: false
        schema:
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
          type: string
      - description: The unique identifier of the incident to assign.
        in: path
        name: incidentID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              UUID of assignee:
                value: 00d53ebf-c386-4b95-ad05-6819517c3450
            schema:
              type: string
        description: Request body containing the assignee information (ID, email, or display name) to assign to the incident.
        required: true
      responses:
        '200':
          description: Successfully updated the incident assignee.
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - Bearer: []
      summary: Assign Incident to User
      tags:
      - Incidents API
  /v1/api/incidents/{incidentID}/notes:
    delete:
      description: "Programmatically delete notes from a DLP incident for auditing and team clarity purposes. \nThis removes previously added notes from the incident record.\n"
      operationId: delete-v1-api-incidents-incidentid-notes
      parameters:
      - description: The unique identifier of the incident.
        in: path
        name: incidentID
        required: true
        schema:
          type: string
      - description: The geographic region of the incident (defaults to US).
        in: query
        name: region
        required: false
        schema:
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
          type: string
      responses:
        '200':
          description: Successfully deleted the incident notes.
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - Bearer: []
      summary: Delete Incident Notes
      tags:
      - Incidents API
    put:
      description: "Programmatically add or update notes on a DLP incident for additional auditing and team clarity. \nNotes provide a way to document findings, actions taken, or other relevant information about the incident.\n"
      operationId: put-v1-api-incidents-incidentid-notes
      parameters:
      - description: The unique identifier of the incident.
        in: path
        name: incidentID
        required: true
        schema:
          type: string
      - description: The geographic region of the incident (defaults to US).
        in: query
        name: region
        required: false
        schema:
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
          type: string
      requestBody:
        content:
          application/json:
            examples:
              sample notes:
                value: This is a note for incident
            schema:
              type: string
        description: Request body containing the note content to add or update on the incident.
        required: true
      responses:
        '200':
          description: Successfully updated the incident notes.
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - Bearer: []
      summary: Update Incident Notes
      tags:
      - Incidents API
  /v1/api/incidents/{incidentID}/resolution-status:
    put:
      description: "Update the resolution status for a specific DLP incident. Track incident lifecycle by changing status \nas incidents are investigated and resolved.\n"
      operationId: put-v1-api-incidents-incidentid-resolution-status
      parameters:
      - description: The unique identifier of the incident.
        in: path
        name: incidentID
        required: true
        schema:
          type: string
      - description: The geographic region of the incident (defaults to US).
        in: query
        name: region
        required: false
        schema:
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
          type: string
      requestBody:
        content:
          application/json:
            examples:
              resolution status:
                value: assigned
            schema:
              type: string
        description: Request body containing the new resolution status to apply to the incident.
        required: true
      responses:
        '200':
          description: Successfully updated the incident resolution status.
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - Bearer: []
      summary: Update Incident Resolution Status
      tags:
      - Incidents API
  /v2/api/incidents:
    get:
      description: "**V2 API for DLP incident retrieval is deprecated. Use [V4 API](https://pan.dev/dlp/api/get-v-4-api-incidents/) to retrieve a paginated list of DLP incidents.**\n\nRetrieve a paginated list of DLP incidents with optional filtering and sorting capabilities. \nThis endpoint provides efficient access to incident datasets through pagination parameters. \nMultiple filtering parameters are combined using an \"AND\" operation for precise results.\n"
      operationId: get-v2-api-incidents
      parameters:
      - description: 'Sort incidents in ascending order by creation time (default: false).'
        in: query
        name: ascending
        required: false
        schema:
          type: boolean
      - description: Filter by channel source (ngfw or prisma-access).
        in: query
        name: channel
        required: false
        schema:
          enum:
          - ngfw
          - prisma-access
          type: string
      - description: The end time of the incident(s) to query in UTC format (e.g., 2023-10-17T02:29:04.402Z).
        in: query
        name: end_time
        required: false
        schema:
          format: date-time
          type: string
      - description: Filter incidents by SHA-256 hash value(s) of associated file(s). Provide comma-separated list.
        in: query
        name: file_shas
        required: false
        schema:
          type: string
      - description: The page number for pagination to retrieve a specific set of incidents.
        in: query
        name: page_number
        required: false
        schema:
          format: int32
          type: integer
      - description: The number of incidents to return per page for pagination.
        in: query
        name: page_size
        required: false
        schema:
          format: int32
          type: integer
      - description: 'The geographic region where the incident was triggered (defaults to US). Valid values: us, eu, uk, jp, in, ap, ca, au, par.'
        in: query
        name: region
        required: false
        schema:
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
          type: string
      - description: Filter incidents by one or more report ID(s).
        in: query
        name: report_ids
        required: false
        schema:
          items:
            type: string
          type: array
      - description: The field to sort incidents by. The default sort order is by creation time.
        in: query
        name: sort_by
        required: false
        schema:
          type: string
      - description: The start time of the incident(s) to query in UTC format (e.g., 2023-10-17T02:29:04.402Z).
        in: query
        name: start_time
        required: false
        schema:
          format: date-time
          type: string
      - description: Filter incidents by one or more user ID(s) associated with the incident.
        in: query
        name: user_ids
        required: false
        schema:
          items:
            type: string
          type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                incidentResponseExample:
                  value:
                    page:
                      number: 1
                      size: 10
                      total_elements: 290
                      total_pages: 29
                    resources:
                    - action: alert
                      channel: ngfw
                      data_profile_id: 11995044
                      data_profile_name: PII
                      file_name: SSNpattern
                      file_sha: a4d58aa3caeb73b56028f597de2b3263d64e2835f277f31c97be53bc76a29e47
                      file_type: pdf
                      incident_creation_time: 2023-Dec-07 18:41:12 UTC
                      incident_id: 7c3dca3d-1c08-4147-b171-9faba84739d4
                      report_id: '1572154781'
                      source: ngfw
                      tenant_id: '5886928188517009408'
                    - action: alert
                      channel: ngfw
                      data_profile_id: 11995410
                      data_profile_name: Portugal_LNAME_high
                      file_name: test_portugal_LNAME.txt
                      file_sha: 6c25d79cd1dee00b3a6ee6bbb985dae6ee5bdfa31a8dfcffa241786c8c3893a7
                      file_type: txt
                      incident_creation_time: 2023-Dec-07 18:39:38 UTC
                      incident_id: 81985a40-dae5-4e80-8147-678892ccfc00
                      report_id: '2968440380'
                      source: ngfw
                      tenant_id: '5886928188517009408'
                    - action: alert
                      channel: ngfw
                      data_profile_id: 11995355
                      data_profile_name: inline_timing_11_12_edm
                      file_name: all_patterns_data_1_MB.txt
                      file_sha: 6c8d18c544aba3b44cfa487d5020ec102a6317a6a5164e270bbecf6ea37df925
                      file_type: txt
                      incident_creation_time: 2023-Dec-06 19:39:46 UTC
                      incident_id: 08f014d8-ed13-490e-bfc4-7363f43a4af1
                      report_id: '1347859663'
                      source: ngfw
                      tenant_id: '5886928188517009408'
                    - action: alert
                      channel: ngfw
                      data_profile_id: 11995295
                      data_profile_name: DemoWideNestedProfile
                      file_name: SSNpattern
                      file_sha: a4d58aa3caeb73b56028f597de2b3263d64e2835f277f31c97be53bc76a29e47
                      file_type: pdf
                      incident_creation_time: 2023-Dec-05 21:54:21 UTC
                      incident_id: 6c7d838a-1b25-44fe-8917-1ff760c0eae5
                      report_id: '3741398016'
                      source: ngfw
                      tenant_id: '5886928188517009408'
              schema:
                $ref: '#/components/schemas/IncidentResponse'
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - Bearer: []
      summary: Retrieve DLP Incidents
      tags:
      - Incidents API
  /v2/api/incidents/{incidentID}:
    get:
      description: "Retrieve comprehensive details for a specific DLP incident using its unique incident ID. Similar to \nviewing DLP Incidents on Panorama, this API allows you to programmatically access detailed incident \ninformation.\n\nWhen using this API, note the following:\n* Multiple filtering parameters (such as report ID, user ID, file SHA, and channel) are combined using an \"AND\" operation\n* All filters perform exact matches\n* Fields with null values are excluded from the response\n"
      operationId: get-v2-api-incidents-incidentid
      parameters:
      - description: The unique identifier of the incident to retrieve.
        examples:
          IncidentID Example:
            value: 3fb38abe-a83b-44e5-99d5-4bec3765bba6
        in: path
        name: incidentID
        required: true
        schema:
          type: string
      - description: region(default to us)
        in: query
        name: region
        schema:
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                incident detail:
                  value:
                    action: alert
                    channel: ngfw
                    data_profile_id: 11995044
                    data_profile_name: PII
                    file_name: SSNpattern
                    file_sha: a4d58aa3caeb73b56028f597de2b3263d64e2835f277f31c97be53bc76a29e47
                    incident_creation_time: 2024-Jan-18 21:46:54 UTC
                    incident_id: 1a762308-3735-4d29-8edd-4595d4e3f982
                    match_info:
                      6374e1b4dee31d91c40b1705:
                        detection_technique: regex
                        hcf: 0
                        lcf: 5
                        mcf: 0
                        name: Driver License - Slovenia
                        uhcf: 0
                        ulcf: 5
                        umcf: 0
                        version: 1
                      6374e1b4dee31d91c40b1708:
                        detection_technique: regex
                        hcf: 0
                        lcf: 13
                        mcf: 0
                        name: Driver License - Canada
                        uhcf: 0
                        ulcf: 13
                        umcf: 0
                        version: 1
                      6374e1b4dee31d91c40b1709:
                        detection_technique: regex
                        hcf: 0
                        lcf: 17
                        mcf: 0
                        name: Driver License - US
                        uhcf: 0
                        ulcf: 17
                        umcf: 0
                        version: 1
                    report_id: '1107089697'
                    snippets:
                      6374e1b4dee31d91c40b1705:
                        low_confidence_detections:
                        - detection: '*******00'
                          left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip "
                          origOffSet: 75
                          original_text: '*******00'
                          right: ' | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-**'
                          textLength: 0
                        - detection: '*******55'
                          left: 'HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1030 ******1031 NINO GP 32 76 63 *****280B Germany Tax ID *******1827 *******8911 *******8796 visa 4556501518562241 4929091695478411 aba '
                          origOffSet: 446
                          original_text: '*******55'
                          right: ' *****3532 ssn 098-07-33 16 480-33-1945 Canada SIN *** *** 425 *****3197 Australia Tax ID 45322 1716 98754015 Access Key ID 022QF06E7MXBSH9DHM02 AWS Secret Key kWcrlUX5JEDGM/LtmEENI/ aVmYvHNif5zB+d9+c'
                          textLength: 0
                        - detection: '*****3532'
                          left: 'BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1030 ******1031 NINO GP 32 76 63 *****280B Germany Tax ID *******1827 *******8911 *******8796 visa 4556501518562241 4929091695478411 aba *******55 '
                          origOffSet: 456
                          original_text: '*****3532'
                          right: ' ssn 098-07-33 16 480-33-1945 Canada SIN *** *** 425 *****3197 Australia Tax ID 45322 1716 98754015 Access Key ID 022QF06E7MXBSH9DHM02 AWS Secret Key kWcrlUX5JEDGM/LtmEENI/ aVmYvHNif5zB+d9+ct ;5301250'
                          textLength: 0
                        version: 1
                      6374e1b4dee31d91c40b1708:
                        low_confidence_detections:
                        - detection: '*******00'
                          left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip "
                          origOffSet: 75
                          original_text: '*******00'
                          right: ' | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-**'
                          textLength: 0
                        - detection: '*****5341'
                          left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA *****3839 | "
                          origOffSet: 113
                          original_text: '*****5341'
                          right: ' CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1030 ******10'
                          textLength: 0
                        - detection: '*****3839'
                          left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA "
                          origOffSet: 101
                          original_text: '*****3839'
                          right: ' | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1'
                          textLength: 0
                        version: 1
                      6374e1b4dee31d91c40b1709:
                        low_confidence_detections:
                        - detection: '*******00'
                          left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip "
                          origOffSet: 75
                          original_text: '*******00'
                          right: ' | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-**'
                          textLength: 0
                        - detection: '******'
                          left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402\nHETU number "
                          origOffSet: 164
                          original_text: '******'
                          right: '-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1030 ******1031 NINO GP 32 76 63 *****280B Germany Tax ID ***'
                          textLength: 0
                        - detection: '***-**-**99'
                          left: "\n\n\n\n\n\n tax id number "
                          origOffSet: 21
                          original_text: '***-**-**99'
                          right: ' abs cupp

                            IBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-***'
                          textLength: 0
                        version: 1
                    source: ngfw
                    tenant_id: '5886928188517009408'
              schema:
                $ref: '#/components/schemas/IncidentResponseDTO'
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - Bearer: []
      summary: Retrieve Specific DLP Incident Details
      tags:
      - Incidents API
components:
  schemas:
    IncidentResponse:
      properties:
        page:
          $ref: '#/components/schemas/PageData'
          description: The current page number in the paginated response.
        resources:
          description: The list of incident resources in the current response, including their status (open, under review, resolved, or closed).
          items:
            $ref: '#/components/schemas/IncidentDTO'
          type: array
      required:
      - page
      title: PagedDataResponse<IncidentDTO>
      type: object
    MatchInfo:
      properties:
        detection_technique:
          description: The technique used to identify the pattern match (e.g., regex, machine learning, exact data matching).
          enum:
          - document_fingerprint
          - edm
          - file_property
          - ml
          - ml_document
          - regex
          - titus_tag
          - trainable_classifier
          - weighted_regex
          type: string
        edm_columns:
          description: Exact Data Matching (EDM) columns used for detection. EDM is a method of detecting and protecting sensitive content by using specific data such as patient names, social security numbers, or bank account numbers to identify matches.
          items:
            type: string
          type: array
          uniqueItems: true
        hcf:
          description: The count of high confidence frequency detections for this pattern.
          format: int32
          type: integer
        lcf:
          description: The count of low confidence frequency detections for this pattern.
          format: int32
          type: integer
        mcf:
          description: The count of medium confidence frequency detections for this pattern.
          format: int32
          type: integer
        name:
          description: The name of the data pattern that was matched.
          type: string
        uhcf:
          description: The count of unique high confidence frequency detections for this pattern.
          format: int32
          type: integer
        ulcf:
          description: The count of unique low confidence frequency detections for this pattern.
          format: int32
          type: integer
        umcf:
          description: The count of unique medium confidence frequency detections for this pattern.
          format: int32
          type: integer
        version:
          description: The version number of the data pattern definition used for detection.
          format: int32
          type: integer
      title: MatchInfo
      type: object
    PageData:
      properties:
        number:
          description: The current page number for pagination.
          format: int32
          type: integer
        size:
          description: The number of items returned in the current page.
          format: int32
          type: integer
        total_elements:
          description: The total number of incidents matching the query criteria.
          format: int32
          type: integer
        total_pages:
          description: The total number of pages available for the query results.
          format: int32
          type: integer
      title: PageData
      type: object
    IncidentDTO:
      properties:
        action:
          description: The action taken on the incident by the DLP system or administrator (alert, block, or none).
          enum:
          - alert
          - block
          - none
          type: string
        app_id:
          description: The unique identifier of the application associated with the incident.
          type: string
        app_name:
          description: The name of the application where the incident was detected.
          type: string
        channel:
          description: The Palo Alto Networks product or channel through which the incident was detected (ngfw or prisma-access).
          enum:
          - ngfw
          - prisma-access
          type: string
        data_profile_id:
          description: The unique identifier of the data profile used to detect the incident.
          format: int64
          type: integer
        data_profile_name:
          description: The name of the data profile used to detect the incident.
          type: string
        file_name:
          description: The name of the file associated with the incident.
          type: string
        file_sha:
          description: The SHA-256 hash value of the file associated with the incident.
          type: string
        file_type:
          description: The file type or extension of the file associated with the incident.
          type: string
        incident_creation_time:
          description: The timestamp when the incident was first detected and created.
          example: yyyy-MMM-dd HH:mm:ss z
          type: string
        incident_id:
          description: The unique identifier automatically assigned to the incident by the system.
          format: uuid
          type: string
        report_id:
          description: The unique identifier automatically assigned to the associated report.
          type: string
        source:
          description: The Palo Alto Networks source system that detected the incident.
          type: string
        tenant_id:
          description: The unique identifier of the Tenant Service Group 

# --- truncated at 32 KB (38 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-incidents-api-api-openapi.yml