Palo Alto Networks Incidents API
Incident management and investigation.
Operations 20
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Ask an LLM
“Which Cortex XDR incidents are open right now at high severity?”
“Can I filter XDR incidents by creation time to see what came in overnight?”
Tell an agent
Pull the Cortex XDR incidents matching filter {request_data}.
List my newest Cortex XDR incidents that are still new or under investigation.
POST
/incidents/get_incident_extra_data
Get a Cortex XDR incident with its alerts · Palo Alto Networks Get Incident Details
#
Ask an LLM
“How do I see every alert and artifact attached to one Cortex XDR incident?”
“Which endpoints and file hashes are tied to a specific XDR incident?”
Tell an agent
Get the full Cortex XDR incident details, alerts and network artifacts for {request_data}.
Show the file artifacts and endpoints for the XDR incident described in {request_data}.
Ask an LLM
“How do I reassign a Cortex XDR incident to another analyst?”
“Can I change the severity of an XDR incident without touching its other fields?”
Tell an agent
Update the Cortex XDR incident with the changes in {request_data}.
Set the status and assignee on an XDR incident using {request_data}.
POST
/incident_management/get_incidents
List Xpanse attack surface incidents · Palo Alto Networks Get Attack Surface Incidents
#
Ask an LLM
“Which attack surface exposures has Xpanse flagged that still need remediation?”
“Can I list Xpanse incidents about misconfigured certificates or shadow IT?”
Tell an agent
List Xpanse attack surface incidents matching {request_data}.
Show the unresolved attack surface incidents assigned to my team.
POST
/incident_management/update_incident
Update an Xpanse attack surface incident · Palo Alto Networks Update Attack Surface Incident
#
Ask an LLM
“How do I close an attack surface incident once the exposure is fixed?”
“Can I record resolution details on an Xpanse incident to track remediation?”
Tell an agent
Update the Xpanse attack surface incident using {request_data}.
Mark the attack surface exposure in {request_data} as resolved.
Ask an LLM
“How do I open a new incident in Cortex XSOAR from an external alert?”
“Can XSOAR start an investigation automatically when I create an incident?”
Tell an agent
Create an XSOAR incident named {name} of type {type} with severity {severity}.
Open an XSOAR incident called {name} owned by {owner} and start its investigation.
GET
/incidents/search
Search XSOAR incidents with a query string · Palo Alto Networks Search Incidents (GET)
#
Ask an LLM
“Can I search XSOAR incidents with a Lucene query like status:Active AND severity:High?”
“What XSOAR incidents were created between two dates?”
Tell an agent
Search XSOAR incidents with query {query} and return {size} results.
Find XSOAR incidents created from {fromdate} to {todate} via the URL query search.
POST
/incidents/search
Search XSOAR incidents with a structured filter · Palo Alto Networks Search Incidents (POST)
#
Ask an LLM
“How do I run a complex XSOAR incident search with field selection and sorting?”
“Can I page through XSOAR search results using a structured filter body?”
Tell an agent
Search XSOAR incidents using structured filter {filter}.
Run a structured XSOAR incident search for {filter} between {fromDate} and {toDate}.
Ask an LLM
“How do I fetch every field of one XSOAR incident?”
“Where do I get an XSOAR incident's current version before updating it?”
Tell an agent
Get XSOAR incident {id}.
Show all fields and metadata for XSOAR incident {id}.
Ask an LLM
“How do I close an XSOAR incident with a close reason and notes?”
“Does updating an XSOAR incident need its version for optimistic locking?”
Tell an agent
Set XSOAR incident {id} to status {status} and owner {owner}.
Close XSOAR incident {id} with reason {closeReason} and notes {closeNotes}.
Ask an LLM
“Which DLP incidents found sensitive data across my monitored channels this month?”
“Can I filter data loss prevention incidents by severity and status?”
Tell an agent
List DLP incidents with severity {severity} and status {status}.
Show DLP incidents detected between {start_time} and {end_time}.
Ask an LLM
“Who was the user behind a particular DLP incident and what file was involved?”
“How do I see the remediation history of one DLP incident?”
Tell an agent
Get DLP incident {incident_id}.
Show the data pattern match context for DLP incident {incident_id}.
PUT
/incidents/{incident_id}
Update a DLP incident's status · Palo Alto Networks Update DLP Incident
#
Ask an LLM
“How do I move a DLP incident forward in the review workflow?”
“Can I add reviewer comments to a DLP incident?”
Tell an agent
Set DLP incident {incident_id} to status {status}.
Add reviewer comments {reviewer_comments} to DLP incident {incident_id}.
GET
/incidents/{incident_id}/snippets
Get DLP match snippets for an incident · Palo Alto Networks Get Incident Content Snippets
#
Ask an LLM
“Can I see the text around the sensitive data that triggered a DLP policy?”
“Are matched values masked in DLP incident snippets?”
Tell an agent
Get the content snippets for DLP incident {incident_id}.
Show what surrounded the matched sensitive data in incident {incident_id}.
Ask an LLM
“Which emails or attachments leaked sensitive data this week?”
“Can I page through email DLP incidents filtered by status?”
Tell an agent
List email DLP incidents with status {status}.
Show email DLP incidents between {start_time} and {end_time}.
GET
/email-incidents/{id}
Get an email DLP incident · Palo Alto Networks Get Email Incident Details
#
Ask an LLM
“Who sent the email that triggered a DLP incident and who received it?”
“What verdict was applied to a specific email DLP incident?”
Tell an agent
Get email DLP incident {id}.
Show the sender, recipients and subject of email incident {id}.
PUT
/email-incidents/{id}/verdict
Allow or block a flagged email · Palo Alto Networks Update Email Incident Verdict
#
Ask an LLM
“How do I release a quarantined email that DLP blocked by mistake?”
“Can I override the automated verdict on an email incident and record why?”
Tell an agent
Set the verdict of email incident {id} to {verdict}.
Allow the blocked email in incident {id} with comment {comment}.
Ask an LLM
“Which SaaS apps have open incidents like external sharing of sensitive files?”
“Can I filter SaaS Security incidents by application and date range?”
Tell an agent
List SaaS Security incidents for app {app_id}.
Show SaaS Security incidents with severity {severity} created since {start_date}.
Ask an LLM
“Which users and assets were affected by a particular SaaS Security incident?”
“What is the event timeline for one SaaS app incident?”
Tell an agent
Get SaaS Security incident {id}.
Show the policy violations and remediation status of SaaS incident {id}.
Ask an LLM
“How do I assign a SaaS Security incident to someone from my SOAR playbook?”
“Can I add a note to a SaaS incident's timeline?”
Tell an agent
Assign SaaS Security incident {id} to user {assignee_id}.
Add note {note} to SaaS incident {id} and set status {status}.