Palo Alto Networks Incidents API API
The Incidents API API from Palo Alto Networks — 7 operation(s) for incidents api.
OpenAPI Specification
openapi: 3.2.0
info:
contact: {}
description: "Manage and retrieve DLP incidents across v1 and v2 endpoints. This API group provides comprehensive \nincident lifecycle management including retrieval with advanced filtering, assignment management, \nnotes management, and resolution status tracking for both legacy and current API versions.\n"
license:
name: MIT
url: https://opensource.org/license/mit
title: Incidents Incidents API API
version: 1.0.0
servers:
- url: https://api.dlp.paloaltonetworks.com
tags:
- name: Incidents API
paths:
/v1/api/incidents/assignee:
get:
description: "Retrieve information about all assignees in your organization. This allows you to programmatically \naccess a list of team members who can examine and manage DLP incidents.\n"
operationId: get-v1-api-incidents-assignee
responses:
'200':
content:
application/json:
examples:
assignees:
value:
- createdAt: 2024-Jan-11 23:16:33 UTC
emailAddress: test@test.com
firstName: test u
id: 00d53ebf-c386-4b95-ad05-6819517c3450
lastName: test
status: ACTIVE
tenantId: '5886928188517009408'
updatedAt: 2024-Feb-14 19:13:01 UTC
- createdAt: 2023-Aug-03 21:23:39 UTC
emailAddress: user1@test.com
firstName: user
id: 133b9b0d-6e64-40ca-abec-15ff3b906b80
lastName: my last name
status: ACTIVE
tenantId: '5886928188517009408'
schema:
items:
$ref: '#/components/schemas/IncidentAssignee'
type: array
description: Successfully retrieved all assignees.
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'500':
description: Internal server error
security:
- Bearer: []
summary: Retrieve All Assignees
tags:
- Incidents API
put:
description: "Update information about assignees who can examine and manage DLP incidents. This allows you to \nprogrammatically maintain assignee details such as contact information and status.\n"
operationId: put-v1-api-incidents-assignee
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentAssigneeDTO'
description: Request body containing the assignee information to update.
required: true
responses:
'200':
description: Successfully updated assignee information.
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'500':
description: Internal server error
security:
- Bearer: []
summary: Update Assignee Information
tags:
- Incidents API
/v1/api/incidents/assignee/{assigneeId}:
get:
description: "Retrieve detailed information about a specific assignee including contact information and status. \nThis allows you to programmatically access information about team members who can examine and manage DLP incidents.\n"
operationId: get-v1-api-incidents-assignee-assigneeid
parameters:
- description: The unique identifier of the assignee.
in: path
name: assigneeId
required: true
schema:
type: string
responses:
'200':
content:
application/json:
examples:
assignee:
value:
createdAt: 2024-Jan-11 23:16:33 UTC
emailAddress: test@test.com
firstName: test
id: 00d53ebf-c386-4b95-ad05-6819517c3450
lastName: test
status: ACTIVE
tenantId: '5886928188517009408'
schema:
$ref: '#/components/schemas/IncidentAssignee'
description: OK
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'500':
description: Internal server error
security:
- Bearer: []
summary: Retrieve Assignee Details
tags:
- Incidents API
/v1/api/incidents/{incidentID}/assignee:
put:
description: 'Assign a DLP incident to a specific user or team member. Once assigned, the assignee can then:
* Update incident notes
* Update incident resolution status
* Manage incident lifecycle
'
operationId: put-v1-api-incidents-incidentid-assignee
parameters:
- description: The geographic region of the incident (defaults to US).
in: query
name: region
required: false
schema:
enum:
- us
- eu
- uk
- jp
- in
- ap
- ca
- au
- par
type: string
- description: The unique identifier of the incident to assign.
in: path
name: incidentID
required: true
schema:
type: string
requestBody:
content:
application/json:
examples:
UUID of assignee:
value: 00d53ebf-c386-4b95-ad05-6819517c3450
schema:
type: string
description: Request body containing the assignee information (ID, email, or display name) to assign to the incident.
required: true
responses:
'200':
description: Successfully updated the incident assignee.
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'500':
description: Internal server error
security:
- Bearer: []
summary: Assign Incident to User
tags:
- Incidents API
/v1/api/incidents/{incidentID}/notes:
delete:
description: "Programmatically delete notes from a DLP incident for auditing and team clarity purposes. \nThis removes previously added notes from the incident record.\n"
operationId: delete-v1-api-incidents-incidentid-notes
parameters:
- description: The unique identifier of the incident.
in: path
name: incidentID
required: true
schema:
type: string
- description: The geographic region of the incident (defaults to US).
in: query
name: region
required: false
schema:
enum:
- us
- eu
- uk
- jp
- in
- ap
- ca
- au
- par
type: string
responses:
'200':
description: Successfully deleted the incident notes.
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'500':
description: Internal server error
security:
- Bearer: []
summary: Delete Incident Notes
tags:
- Incidents API
put:
description: "Programmatically add or update notes on a DLP incident for additional auditing and team clarity. \nNotes provide a way to document findings, actions taken, or other relevant information about the incident.\n"
operationId: put-v1-api-incidents-incidentid-notes
parameters:
- description: The unique identifier of the incident.
in: path
name: incidentID
required: true
schema:
type: string
- description: The geographic region of the incident (defaults to US).
in: query
name: region
required: false
schema:
enum:
- us
- eu
- uk
- jp
- in
- ap
- ca
- au
- par
type: string
requestBody:
content:
application/json:
examples:
sample notes:
value: This is a note for incident
schema:
type: string
description: Request body containing the note content to add or update on the incident.
required: true
responses:
'200':
description: Successfully updated the incident notes.
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'500':
description: Internal server error
security:
- Bearer: []
summary: Update Incident Notes
tags:
- Incidents API
/v1/api/incidents/{incidentID}/resolution-status:
put:
description: "Update the resolution status for a specific DLP incident. Track incident lifecycle by changing status \nas incidents are investigated and resolved.\n"
operationId: put-v1-api-incidents-incidentid-resolution-status
parameters:
- description: The unique identifier of the incident.
in: path
name: incidentID
required: true
schema:
type: string
- description: The geographic region of the incident (defaults to US).
in: query
name: region
required: false
schema:
enum:
- us
- eu
- uk
- jp
- in
- ap
- ca
- au
- par
type: string
requestBody:
content:
application/json:
examples:
resolution status:
value: assigned
schema:
type: string
description: Request body containing the new resolution status to apply to the incident.
required: true
responses:
'200':
description: Successfully updated the incident resolution status.
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'500':
description: Internal server error
security:
- Bearer: []
summary: Update Incident Resolution Status
tags:
- Incidents API
/v2/api/incidents:
get:
description: "**V2 API for DLP incident retrieval is deprecated. Use [V4 API](https://pan.dev/dlp/api/get-v-4-api-incidents/) to retrieve a paginated list of DLP incidents.**\n\nRetrieve a paginated list of DLP incidents with optional filtering and sorting capabilities. \nThis endpoint provides efficient access to incident datasets through pagination parameters. \nMultiple filtering parameters are combined using an \"AND\" operation for precise results.\n"
operationId: get-v2-api-incidents
parameters:
- description: 'Sort incidents in ascending order by creation time (default: false).'
in: query
name: ascending
required: false
schema:
type: boolean
- description: Filter by channel source (ngfw or prisma-access).
in: query
name: channel
required: false
schema:
enum:
- ngfw
- prisma-access
type: string
- description: The end time of the incident(s) to query in UTC format (e.g., 2023-10-17T02:29:04.402Z).
in: query
name: end_time
required: false
schema:
format: date-time
type: string
- description: Filter incidents by SHA-256 hash value(s) of associated file(s). Provide comma-separated list.
in: query
name: file_shas
required: false
schema:
type: string
- description: The page number for pagination to retrieve a specific set of incidents.
in: query
name: page_number
required: false
schema:
format: int32
type: integer
- description: The number of incidents to return per page for pagination.
in: query
name: page_size
required: false
schema:
format: int32
type: integer
- description: 'The geographic region where the incident was triggered (defaults to US). Valid values: us, eu, uk, jp, in, ap, ca, au, par.'
in: query
name: region
required: false
schema:
enum:
- us
- eu
- uk
- jp
- in
- ap
- ca
- au
- par
type: string
- description: Filter incidents by one or more report ID(s).
in: query
name: report_ids
required: false
schema:
items:
type: string
type: array
- description: The field to sort incidents by. The default sort order is by creation time.
in: query
name: sort_by
required: false
schema:
type: string
- description: The start time of the incident(s) to query in UTC format (e.g., 2023-10-17T02:29:04.402Z).
in: query
name: start_time
required: false
schema:
format: date-time
type: string
- description: Filter incidents by one or more user ID(s) associated with the incident.
in: query
name: user_ids
required: false
schema:
items:
type: string
type: array
responses:
'200':
content:
application/json:
examples:
incidentResponseExample:
value:
page:
number: 1
size: 10
total_elements: 290
total_pages: 29
resources:
- action: alert
channel: ngfw
data_profile_id: 11995044
data_profile_name: PII
file_name: SSNpattern
file_sha: a4d58aa3caeb73b56028f597de2b3263d64e2835f277f31c97be53bc76a29e47
file_type: pdf
incident_creation_time: 2023-Dec-07 18:41:12 UTC
incident_id: 7c3dca3d-1c08-4147-b171-9faba84739d4
report_id: '1572154781'
source: ngfw
tenant_id: '5886928188517009408'
- action: alert
channel: ngfw
data_profile_id: 11995410
data_profile_name: Portugal_LNAME_high
file_name: test_portugal_LNAME.txt
file_sha: 6c25d79cd1dee00b3a6ee6bbb985dae6ee5bdfa31a8dfcffa241786c8c3893a7
file_type: txt
incident_creation_time: 2023-Dec-07 18:39:38 UTC
incident_id: 81985a40-dae5-4e80-8147-678892ccfc00
report_id: '2968440380'
source: ngfw
tenant_id: '5886928188517009408'
- action: alert
channel: ngfw
data_profile_id: 11995355
data_profile_name: inline_timing_11_12_edm
file_name: all_patterns_data_1_MB.txt
file_sha: 6c8d18c544aba3b44cfa487d5020ec102a6317a6a5164e270bbecf6ea37df925
file_type: txt
incident_creation_time: 2023-Dec-06 19:39:46 UTC
incident_id: 08f014d8-ed13-490e-bfc4-7363f43a4af1
report_id: '1347859663'
source: ngfw
tenant_id: '5886928188517009408'
- action: alert
channel: ngfw
data_profile_id: 11995295
data_profile_name: DemoWideNestedProfile
file_name: SSNpattern
file_sha: a4d58aa3caeb73b56028f597de2b3263d64e2835f277f31c97be53bc76a29e47
file_type: pdf
incident_creation_time: 2023-Dec-05 21:54:21 UTC
incident_id: 6c7d838a-1b25-44fe-8917-1ff760c0eae5
report_id: '3741398016'
source: ngfw
tenant_id: '5886928188517009408'
schema:
$ref: '#/components/schemas/IncidentResponse'
description: OK
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'500':
description: Internal server error
security:
- Bearer: []
summary: Retrieve DLP Incidents
tags:
- Incidents API
/v2/api/incidents/{incidentID}:
get:
description: "Retrieve comprehensive details for a specific DLP incident using its unique incident ID. Similar to \nviewing DLP Incidents on Panorama, this API allows you to programmatically access detailed incident \ninformation.\n\nWhen using this API, note the following:\n* Multiple filtering parameters (such as report ID, user ID, file SHA, and channel) are combined using an \"AND\" operation\n* All filters perform exact matches\n* Fields with null values are excluded from the response\n"
operationId: get-v2-api-incidents-incidentid
parameters:
- description: The unique identifier of the incident to retrieve.
examples:
IncidentID Example:
value: 3fb38abe-a83b-44e5-99d5-4bec3765bba6
in: path
name: incidentID
required: true
schema:
type: string
- description: region(default to us)
in: query
name: region
schema:
enum:
- us
- eu
- uk
- jp
- in
- ap
- ca
- au
- par
type: string
responses:
'200':
content:
application/json:
examples:
incident detail:
value:
action: alert
channel: ngfw
data_profile_id: 11995044
data_profile_name: PII
file_name: SSNpattern
file_sha: a4d58aa3caeb73b56028f597de2b3263d64e2835f277f31c97be53bc76a29e47
incident_creation_time: 2024-Jan-18 21:46:54 UTC
incident_id: 1a762308-3735-4d29-8edd-4595d4e3f982
match_info:
6374e1b4dee31d91c40b1705:
detection_technique: regex
hcf: 0
lcf: 5
mcf: 0
name: Driver License - Slovenia
uhcf: 0
ulcf: 5
umcf: 0
version: 1
6374e1b4dee31d91c40b1708:
detection_technique: regex
hcf: 0
lcf: 13
mcf: 0
name: Driver License - Canada
uhcf: 0
ulcf: 13
umcf: 0
version: 1
6374e1b4dee31d91c40b1709:
detection_technique: regex
hcf: 0
lcf: 17
mcf: 0
name: Driver License - US
uhcf: 0
ulcf: 17
umcf: 0
version: 1
report_id: '1107089697'
snippets:
6374e1b4dee31d91c40b1705:
low_confidence_detections:
- detection: '*******00'
left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip "
origOffSet: 75
original_text: '*******00'
right: ' | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402
HETU number ******-856E | *******0490
CPF | **************1-30 CNPJ
*-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-**'
textLength: 0
- detection: '*******55'
left: 'HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333
UK Tax UTR ******1030 ******1031 NINO GP 32 76 63 *****280B Germany Tax ID *******1827 *******8911 *******8796 visa 4556501518562241 4929091695478411 aba '
origOffSet: 446
original_text: '*******55'
right: ' *****3532 ssn 098-07-33 16 480-33-1945 Canada SIN *** *** 425 *****3197 Australia Tax ID 45322 1716 98754015 Access Key ID 022QF06E7MXBSH9DHM02 AWS Secret Key kWcrlUX5JEDGM/LtmEENI/ aVmYvHNif5zB+d9+c'
textLength: 0
- detection: '*****3532'
left: 'BANGŌ SEIDO MAINANBA ****-****-6333
UK Tax UTR ******1030 ******1031 NINO GP 32 76 63 *****280B Germany Tax ID *******1827 *******8911 *******8796 visa 4556501518562241 4929091695478411 aba *******55 '
origOffSet: 456
original_text: '*****3532'
right: ' ssn 098-07-33 16 480-33-1945 Canada SIN *** *** 425 *****3197 Australia Tax ID 45322 1716 98754015 Access Key ID 022QF06E7MXBSH9DHM02 AWS Secret Key kWcrlUX5JEDGM/LtmEENI/ aVmYvHNif5zB+d9+ct ;5301250'
textLength: 0
version: 1
6374e1b4dee31d91c40b1708:
low_confidence_detections:
- detection: '*******00'
left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip "
origOffSet: 75
original_text: '*******00'
right: ' | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402
HETU number ******-856E | *******0490
CPF | **************1-30 CNPJ
*-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-**'
textLength: 0
- detection: '*****5341'
left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA *****3839 | "
origOffSet: 113
original_text: '*****5341'
right: ' CLIA 24C3872984 | 05D0911402
HETU number ******-856E | *******0490
CPF | **************1-30 CNPJ
*-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333
UK Tax UTR ******1030 ******10'
textLength: 0
- detection: '*****3839'
left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA "
origOffSet: 101
original_text: '*****3839'
right: ' | *****5341 CLIA 24C3872984 | 05D0911402
HETU number ******-856E | *******0490
CPF | **************1-30 CNPJ
*-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333
UK Tax UTR ******1'
textLength: 0
version: 1
6374e1b4dee31d91c40b1709:
low_confidence_detections:
- detection: '*******00'
left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip "
origOffSet: 75
original_text: '*******00'
right: ' | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402
HETU number ******-856E | *******0490
CPF | **************1-30 CNPJ
*-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-**'
textLength: 0
- detection: '******'
left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402\nHETU number "
origOffSet: 164
original_text: '******'
right: '-856E | *******0490
CPF | **************1-30 CNPJ
*-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333
UK Tax UTR ******1030 ******1031 NINO GP 32 76 63 *****280B Germany Tax ID ***'
textLength: 0
- detection: '***-**-**99'
left: "\n\n\n\n\n\n tax id number "
origOffSet: 21
original_text: '***-**-**99'
right: ' abs cupp
IBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402
HETU number ******-856E | *******0490
CPF | **************1-30 CNPJ
*-****-***'
textLength: 0
version: 1
source: ngfw
tenant_id: '5886928188517009408'
schema:
$ref: '#/components/schemas/IncidentResponseDTO'
description: OK
'400':
description: Bad Request
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'500':
description: Internal server error
security:
- Bearer: []
summary: Retrieve Specific DLP Incident Details
tags:
- Incidents API
components:
schemas:
PageData:
properties:
number:
description: The current page number for pagination.
format: int32
type: integer
size:
description: The number of items returned in the current page.
format: int32
type: integer
total_elements:
description: The total number of incidents matching the query criteria.
format: int32
type: integer
total_pages:
description: The total number of pages available for the query results.
format: int32
type: integer
title: PageData
type: object
IncidentResponse:
properties:
page:
$ref: '#/components/schemas/PageData'
description: The current page number in the paginated response.
resources:
description: The list of incident resources in the current response, including their status (open, under review, resolved, or closed).
items:
$ref: '#/components/schemas/IncidentDTO'
type: array
required:
- page
title: PagedDataResponse<IncidentDTO>
type: object
IncidentResponseDTO:
example:
action: alert
assignee_id: 00d53ebf-c386-4b95-ad05-6819517c3450
channel: prisma-access
data_profile_id: 11995590
data_profile_name: PatricksDPwEDM
file_name: 100_rows_10_cols_tail.csv
file_sha: 9d8ce237eff10b5ac4b4c8fed0d7988ca6cc4f090f90230acd8dad36fb7da636
incident_creation_time: 2024-Jan-11 17:14:30 UTC
incident_id: 4adeefe4-8358-411e-8ba7-5f45e5625c58
incident_notes: test notes
match_info:
65a0209ce36cd3480011d677:
detection_technique: edm
edm_columns:
- credit_card_number
- social_security_number
hcf: 10
lcf: 10
mcf: 0
name: EDM - PatricksDataSet20240111
uhcf: 10
ulcf: 10
umcf: 0
version: 1
report_id: '530470823'
resolution_status: Assigned
source: prisma-access
tenant_id: '5886928188517009408'
properties:
action:
description: Action taken on the incident by the DLP system or administrator.
enum:
- alert
- block
type: string
app_id:
description: Palo Alto Networks assigned Application ID.
type: string
app_name:
description: The name of the application.
type: string
assignee_id:
description: Automatically assigned ID of the assignee.
type: string
channel:
description: The Palo Alto Networks channel that identified the incident.
enum:
- ngfw
- prisma-access
type: string
data_profile_id:
description: The data profile descriptor used to characterize the incident.
format: int64
type: integer
data_profile_name:
description: The data profile descriptor used to characterize the incident.
type: string
file_name:
description: The name of the file analyzed.
type: string
file_sha:
description: The SHA hash of the file analyzed.
type: string
file_type:
description: The type of file analyzed.
type: string
incident_creation_time:
description: The time the incident first occurred.
example: yyyy-MMM-dd HH:mm:ss z
type: string
incident_feedback_status:
description: Feedback status for the incident (e.g., true positive, false positive).
type: string
incident_id:
description: The Palo Alto Networks automatically assigned incident ID.
format: uuid
type: string
incident_notes:
description: Notes or comments added to the incident for documentation and tracking.
type: string
match_info:
$ref: '#/components/schemas/MatchInfo'
description: ''
example: "\"65a0209ce36cd3480011d677\": {\n \"name\": \"EDM - PatricksDataSet20240111\",\n \"version\": 1,\n \"lcf\": 10,\n \"hcf\": 10,\n \"mcf\": 0,\n \"ulcf\": 10,\n \"uhcf\": 10,\n \"umcf\": 0,\n \"detection_technique\": \"edm\",\n \"edm_columns\": [\n \"credit_card_number\",\n \"social_security_number\"\n ]\n }\n"
report_id:
description: The Palo Alto Networks automatically assigned report ID.
type: string
resolution_status:
description: Resolution status for the incident (e.g., open, under review, resolved, closed).
type: string
session_key:
description: Specifies a session key assosciated with the incident.
type: string
snippets:
description: A JSON structure containing snippet data, if snippets are not enabled, the field returns as null.
type: string
source:
description: The Palo Alto Networks source that identified the incident.
type: string
# --- truncated at 32 KB (38 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-incidents-api-api-openapi.yml