Palo Alto Networks Incidents API
Incident management and investigation.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-incidents-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks Incidents API
license:
name: Proprietary
url: https://www.paloaltonetworks.com/legal
version: '1.0'
description: 'Operations tagged Incidents across 8 of this provider''s published API definitions: palo-alto-cortex-xdr-api-openapi-original.yml, palo-alto-cortex-xpanse-api-openapi-original.yml, palo-alto-cortex-xsiam-api-openapi-original.yml, palo-alto-cortex-xsoar-api-openapi-original.yml, palo-alto-dlp-api-openapi-original.yml, palo-alto-email-dlp-api-openapi-original.yml, palo-alto-networks-incidents-api-openapi.yml, palo-alto-saas-security-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api-{fqdn}/public_api/v1
description: Cortex XDR tenant API endpoint.
variables:
fqdn:
description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
default: example.xdr.us.paloaltonetworks.com
- url: https://{xsoar-server}
description: Cortex XSOAR server endpoint.
variables:
xsoar-server:
description: Hostname or IP address of the Cortex XSOAR server.
default: xsoar.example.com
- url: https://api.dlp.paloaltonetworks.com/v4
description: Enterprise DLP API production server.
- url: https://api.{region}.dlp.paloaltonetworks.com/v1
description: Email DLP API production server.
variables:
region:
description: Deployment region for the Email DLP service. Choose the region matching your tenant data residency.
default: us
enum:
- us
- eu
- in
- apac
- uk
- jp
- au
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
- url: https://api.aperture.paloaltonetworks.com
description: SaaS Security (Aperture) API production server.
tags:
- name: Incidents
description: Incident management and investigation.
paths:
/incidents/get_incidents:
post:
operationId: getIncidents
summary: Palo Alto Networks List Incidents
description: Returns a list of incidents matching the specified filter criteria. Incidents group related alerts into a unified investigation context. Supports filtering by incident ID, status, severity, and creation time.
tags:
- Incidents
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
request_data:
type: object
properties:
filters:
type: array
items:
$ref: '#/components/schemas/Filter'
description: Filter criteria to apply to the incident list.
search_from:
type: integer
description: Pagination offset (zero-based).
default: 0
search_to:
type: integer
description: Upper bound of the result range.
default: 100
sort:
$ref: '#/components/schemas/SortOrder'
examples:
GetIncidentsRequestExample:
summary: Default getIncidents request
x-microcks-default: true
value:
request_data:
filters:
- field: example-field
operator: lte
value: example-value
- field: example-field
operator: lte
value: example-value
search_from: 0
search_to: 100
sort:
field: example-field
keyword: asc
responses:
'200':
description: Incidents returned successfully.
content:
application/json:
schema:
type: object
properties:
reply:
type: object
properties:
total_count:
type: integer
result_count:
type: integer
incidents:
type: array
items:
$ref: '#/components/schemas/Incident'
examples:
GetIncidents200Example:
summary: Default getIncidents 200 response
x-microcks-default: true
value:
reply:
total_count: 176
result_count: 940
incidents:
- incident_id: '877543'
incident_name: Branch Gateway 82
description: Firewall traffic applied alert threat blocked Security rule.
status: resolved_threat_handled
severity: informational
assigned_user_mail: analyst1@example.com
assigned_user_pretty_name: Carlos Smith
alert_count: 509
low_severity_alert_count: 929
med_severity_alert_count: 295
high_severity_alert_count: 602
critical_severity_alert_count: 936
user_count: 170
host_count: 720
creation_time: 1707012665747
modification_time: 1744706901976
detection_time: 1704757310414
starred: true
xdr_url: https://portal.acme-systems.org/0455da
rule_based_score: 942
manual_score: 174
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'500':
$ref: '#/components/responses/InternalServerError'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- xdrAuth: []
servers:
- url: https://api-{fqdn}/public_api/v1
description: Cortex XDR tenant API endpoint.
variables:
fqdn:
description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
default: example.xdr.us.paloaltonetworks.com
/incidents/get_incident_extra_data:
post:
operationId: getIncidentExtraData
summary: Palo Alto Networks Get Incident Details
description: Returns detailed information about a specific incident including all associated alerts, network artifacts, file artifacts, and endpoint details.
tags:
- Incidents
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- request_data
properties:
request_data:
type: object
required:
- incident_id
properties:
incident_id:
type: string
description: Unique identifier of the incident.
alerts_limit:
type: integer
description: Maximum number of alerts to include in response.
default: 1000
examples:
GetIncidentExtraDataRequestExample:
summary: Default getIncidentExtraData request
x-microcks-default: true
value:
request_data:
incident_id: '709824'
alerts_limit: 1000
responses:
'200':
description: Incident details returned successfully.
content:
application/json:
schema:
type: object
properties:
reply:
type: object
properties:
incident:
$ref: '#/components/schemas/IncidentDetail'
alerts:
type: object
properties:
total_count:
type: integer
data:
type: array
items:
$ref: '#/components/schemas/Alert'
network_artifacts:
type: object
file_artifacts:
type: object
examples:
GetIncidentExtraData200Example:
summary: Default getIncidentExtraData 200 response
x-microcks-default: true
value:
reply:
incident: example-incident
alerts:
total_count: 428
data:
- alert_id: '999423'
detection_timestamp: 1733555086833
name: Staging Policy 70
category: custom
description: Rule incident incident firewall suspicious monitoring activity threat rule monitoring suspicious detected.
host_ip:
- example-host_ip_item
- example-host_ip_item
host_name: Corporate Agent 14
user_name: jsmith
mac:
- example-mac_item
source: example-source
action: alert
action_pretty: alert
severity: informational
matching_status: running
alert_type: standard
resolution_status: enabled
resolution_comment: Monitoring threat applied Security investigation Security configured.
network_artifacts: {}
file_artifacts: {}
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- xdrAuth: []
servers:
- url: https://api-{fqdn}/public_api/v1
description: Cortex XDR tenant API endpoint.
variables:
fqdn:
description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
default: example.xdr.us.paloaltonetworks.com
/incidents/update_incident:
post:
operationId: updateIncident
summary: Palo Alto Networks Update Incident
description: Updates the status, severity, assignee, or other mutable fields of a specific incident. Only the fields provided in the request body are modified.
tags:
- Incidents
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- request_data
properties:
request_data:
type: object
required:
- incident_id
properties:
incident_id:
type: string
status:
type: string
enum:
- new
- under_investigation
- resolved_threat_handled
- resolved_known_issue
- resolved_duplicate
- resolved_false_positive
- resolved_other
severity:
type: string
enum:
- high
- medium
- low
assigned_user_mail:
type: string
description: Email of the user to assign the incident to.
assigned_user_pretty_name:
type: string
resolve_comment:
type: string
description: Resolution comment (required when closing an incident).
add_comment:
type: string
description: Comment to add to the incident timeline.
examples:
UpdateIncidentRequestExample:
summary: Default updateIncident request
x-microcks-default: true
value:
request_data:
incident_id: '498189'
status: resolved_duplicate
severity: high
assigned_user_mail: security-ops@example.com
assigned_user_pretty_name: Jane Garcia
resolve_comment: Detected endpoint configured policy firewall Security malware rule suspicious alert incident network.
add_comment: Endpoint detected suspicious incident network firewall threat malware configured blocked alert investigation.
responses:
'200':
description: Incident updated successfully.
content:
application/json:
schema:
type: object
properties:
reply:
type: boolean
examples:
UpdateIncident200Example:
summary: Default updateIncident 200 response
x-microcks-default: true
value:
reply: true
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- xdrAuth: []
servers:
- url: https://api-{fqdn}/public_api/v1
description: Cortex XDR tenant API endpoint.
variables:
fqdn:
description: Tenant FQDN from the Cortex XDR settings page (e.g., example.xdr.us.paloaltonetworks.com).
default: example.xdr.us.paloaltonetworks.com
/incident_management/get_incidents:
post:
operationId: getIncidents
summary: Palo Alto Networks Get Attack Surface Incidents
description: Returns a list of attack surface incidents. Xpanse incidents represent confirmed exposures that require remediation such as unintended services, misconfigured certificates, or shadow IT. Supports filtering by status, severity, type, and assignee.
tags:
- Incidents
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
request_data:
type: object
properties:
filters:
type: array
items:
$ref: '#/components/schemas/Filter_2'
search_from:
type: integer
default: 0
search_to:
type: integer
default: 100
sort:
$ref: '#/components/schemas/SortOrder_2'
examples:
GetIncidentsRequestExample:
summary: Default getIncidents request
x-microcks-default: true
value:
request_data:
filters:
- field: example-field
operator: contains
value: example-value
- field: example-field
operator: contains
value: example-value
search_from: 0
search_to: 100
sort:
field: example-field
keyword: asc
responses:
'200':
description: Attack surface incidents returned successfully.
content:
application/json:
schema:
type: object
properties:
reply:
type: object
properties:
total_count:
type: integer
result_count:
type: integer
incidents:
type: array
items:
$ref: '#/components/schemas/AsmIncident'
examples:
GetIncidents200Example:
summary: Default getIncidents 200 response
x-microcks-default: true
value:
reply:
total_count: 723
result_count: 282
incidents:
- incident_id: '593269'
incident_name: Production Agent 40
status: resolved_no_risk
severity: informational
incident_type:
- standard
assigned_user_mail: analyst1@example.com
assigned_user_pretty_name: John Smith
alert_count: 939
description: Alert threat detected Security incident monitoring activity incident.
creation_time: 1704469877477
modification_time: 1740534005374
resolved_by: example-resolved_by
resolve_comment: Rule on firewall violation traffic violation Security detected.
tags:
- key: example-key
value: example-value
- incident_id: '593269'
incident_name: Production Agent 40
status: resolved_no_risk
severity: informational
incident_type:
- standard
assigned_user_mail: analyst1@example.com
assigned_user_pretty_name: John Smith
alert_count: 939
description: Alert threat detected Security incident monitoring activity incident.
creation_time: 1704469877477
modification_time: 1740534005374
resolved_by: example-resolved_by
resolve_comment: Rule on firewall violation traffic violation Security detected.
tags:
- key: example-key
value: example-value
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden_2'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- xpanseAuth: []
servers:
- url: https://api-{fqdn}/public_api/v1
description: Cortex Xpanse tenant API endpoint.
variables:
fqdn:
description: Tenant FQDN from the Xpanse settings page (e.g., example.xpanse.paloaltonetworks.com).
default: example.xpanse.paloaltonetworks.com
/incident_management/update_incident:
post:
operationId: updateIncident
summary: Palo Alto Networks Update Attack Surface Incident
description: Updates the status, assignee, severity, or resolution details of an attack surface incident. Use this endpoint to track remediation progress and close incidents after the exposure has been addressed.
tags:
- Incidents
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- request_data
properties:
request_data:
type: object
required:
- incident_id
properties:
incident_id:
type: string
description: Unique identifier of the attack surface incident.
status:
type: string
enum:
- new
- under_investigation
- resolved
- resolved_no_risk
- resolved_risk_accepted
- resolved_contested_asset
- resolved_remediated_automatically
assigned_user_mail:
type: string
description: Email of the user to assign the incident to.
assigned_user_pretty_name:
type: string
severity:
type: string
enum:
- critical
- high
- medium
- low
- informational
resolve_comment:
type: string
description: Resolution comment when closing an incident.
comment:
type: string
description: Comment to add to the incident.
examples:
UpdateIncidentRequestExample:
summary: Default updateIncident request
x-microcks-default: true
value:
request_data:
incident_id: '742866'
status: resolved_no_risk
assigned_user_mail: analyst1@example.com
assigned_user_pretty_name: John Kumar
severity: low
resolve_comment: Endpoint incident malware on configured on incident policy endpoint.
comment: Security incident rule malware suspicious detected incident traffic violation configured.
responses:
'200':
description: Attack surface incident updated successfully.
content:
application/json:
schema:
type: object
properties:
reply:
type: boolean
examples:
UpdateIncident200Example:
summary: Default updateIncident 200 response
x-microcks-default: true
value:
reply: true
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- xpanseAuth: []
servers:
- url: https://api-{fqdn}/public_api/v1
description: Cortex Xpanse tenant API endpoint.
variables:
fqdn:
description: Tenant FQDN from the Xpanse settings page (e.g., example.xpanse.paloaltonetworks.com).
default: example.xpanse.paloaltonetworks.com
/incident:
post:
operationId: createIncident
summary: Palo Alto Networks Create Incident
description: Creates a new incident in Cortex XSOAR. Incidents represent security events requiring investigation and response. Specify the incident type, severity, name, and any custom fields defined for the incident type. If an associated playbook is configured for the incident type, it starts automatically.
tags:
- Incidents
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateIncidentRequest'
examples:
CreateIncidentRequestExample:
summary: Default createIncident request
x-microcks-default: true
value:
name: Corporate Gateway 34
type: custom
severity: 2
owner: example-owner
occurred: '2025-12-19T01:48:14Z'
details: Traffic rule network firewall endpoint incident network incident configured firewall activity.
labels:
- type: advanced
value: example-value
createInvestigation: true
CustomFields: {}
rawJson: example-rawJson
responses:
'200':
description: Incident created successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Incident_3'
examples:
CreateIncident200Example:
summary: Default createIncident 200 response
x-microcks-default: true
value:
id: example-id
name: Branch Firewall 02
type: custom
status: 2
severity: 5
owner: example-owner
created: '2026-04-27T13:10:38Z'
modified: '2026-02-28T09:07:32Z'
occurred: '2026-07-07T08:02:17Z'
closed: '2025-06-22T23:38:50Z'
closeReason: example-closeReason
closeNotes: Malware firewall on activity applied investigation suspicious detected activity.
labels:
- type: custom
value: example-value
details: Suspicious firewall detected configured suspicious network detected blocked suspicious.
investigationId: '720788'
playbookId: '265379'
sourceInstance: example-sourceInstance
sourceBrand: example-sourceBrand
rawJson: example-rawJson
CustomFields: {}
'400':
$ref: '#/components/responses/BadRequest_2'
'401':
$ref: '#/components/responses/Unauthorized_2'
'500':
$ref: '#/components/responses/InternalServerError'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- apiKey: []
servers:
- url: https://{xsoar-server}
description: Cortex XSOAR server endpoint.
variables:
xsoar-server:
description: Hostname or IP address of the Cortex XSOAR server.
default: xsoar.example.com
/incidents/search:
get:
operationId: searchIncidentsGet
summary: Palo Alto Networks Search Incidents (GET)
description: Returns incidents matching query criteria specified as URL query parameters. Supports filtering by keyword, status, severity, type, and time range. For complex queries use POST /incidents/search.
tags:
- Incidents
parameters:
- name: query
in: query
description: Lucene query string to filter incidents (e.g., status:Active AND severity:High).
schema:
type: string
example: example-query
- name: size
in: query
description: Maximum number of incidents to return.
schema:
type: integer
default: 10
maximum: 100
example: 10
- name: fromdate
in: query
description: Filter incidents created after this date (ISO 8601 format).
schema:
type: string
format: date-time
example: '2025-09-17T20:14:07Z'
- name: todate
in: query
description: Filter incidents created before this date (ISO 8601 format).
schema:
type: string
format: date-time
example: '2025-05-07T00:33:09Z'
- name: page
in: query
description: Page number for pagination (zero-based).
schema:
type: integer
default: 0
example: 0
responses:
'200':
description: Incidents returned successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentSearchResponse'
examples:
SearchIncidentsGet200Example:
summary: Default searchIncidentsGet 200 response
x-microcks-default: true
value:
total:
value: 316
relation: example-relation
incidents:
- id: example-id
name: Branch Firewall 02
type: custom
status: 2
severity: 5
owner: example-owner
created: '2026-04-27T13:10:38Z'
modified: '2026-02-28T09:07:32Z'
occurred: '2026-07-07T08:02:17Z'
closed: '2025-06-22T23:38:50Z'
closeReason: example-closeReason
closeNotes: Malware firewall on activity applied investigation suspicious detected activity.
labels:
- type: custom
value: example-value
details: Suspicious firewall detected configured suspicious network detected blocked suspicious.
investigationId: '720788'
playbookId: '265379'
sourceInstance: example-sourceInstance
sourceBrand: example-sourceBrand
rawJson: example-rawJson
CustomFields: {}
searchResultTotal: 847
'400':
$ref: '#/components/responses/BadRequest_2'
'401':
$ref: '#/components/responses/Unauthorized_2'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
security:
- apiKey: []
post:
operationId: searchIncidentsPost
summary: Palo Alto Networks Search Incidents (POST)
description: Searches for incidents using a structured filter in the request body. Supports advanced filtering, field selection, sorting, and pagination. Preferred over GET for complex queries.
tags:
- Incidents
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentSearchRequest'
examples:
SearchIncidentsPostRequestExample:
summary: Default searchIncidentsPost request
x-microcks-default: true
value:
filter:
query: example-query
status:
- 427
sort:
- field: example-field
asc: true
period:
byFrom: '2026-11-24T23:01:39Z'
byTo: '2025-06-05T03:13:28Z'
fromDate: '2025-04-24T04:56:15Z'
toDate: '2024-07-10T05:59:35Z'
size: 10
page: 0
responses:
'200':
description: Incidents returned successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentSearchResponse'
examples:
SearchIncidentsPost200Example:
summary: Default searchIncidentsPost 200 response
x-microcks-default: true
value:
total:
value: 316
relation: example-relation
incidents:
- id: exampl
# --- truncated at 32 KB (124 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-incidents-api-openapi.yml