Palo Alto Networks Incidents API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Incidents API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Incidents
  description: Incident management and investigation.
paths:
  /incidents/get_incidents:
    post:
      operationId: getIncidents
      summary: Palo Alto Networks List Incidents
      description: Returns a list of incidents matching the specified filter criteria. Incidents group related alerts into a unified investigation context. Supports filtering by incident ID, status, severity, and creation time.
      tags:
      - Incidents
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                request_data:
                  type: object
                  properties:
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter'
                      description: Filter criteria to apply to the incident list.
                    search_from:
                      type: integer
                      description: Pagination offset (zero-based).
                      default: 0
                    search_to:
                      type: integer
                      description: Upper bound of the result range.
                      default: 100
                    sort:
                      $ref: '#/components/schemas/SortOrder'
            examples:
              GetIncidentsRequestExample:
                summary: Default getIncidents request
                x-microcks-default: true
                value:
                  request_data:
                    filters:
                    - field: example-field
                      operator: lte
                      value: example-value
                    - field: example-field
                      operator: lte
                      value: example-value
                    search_from: 0
                    search_to: 100
                    sort:
                      field: example-field
                      keyword: asc
      responses:
        '200':
          description: Incidents returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      result_count:
                        type: integer
                      incidents:
                        type: array
                        items:
                          $ref: '#/components/schemas/Incident'
              examples:
                GetIncidents200Example:
                  summary: Default getIncidents 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      total_count: 176
                      result_count: 940
                      incidents:
                      - incident_id: '877543'
                        incident_name: Branch Gateway 82
                        description: Firewall traffic applied alert threat blocked Security rule.
                        status: resolved_threat_handled
                        severity: informational
                        assigned_user_mail: analyst1@example.com
                        assigned_user_pretty_name: Carlos Smith
                        alert_count: 509
                        low_severity_alert_count: 929
                        med_severity_alert_count: 295
                        high_severity_alert_count: 602
                        critical_severity_alert_count: 936
                        user_count: 170
                        host_count: 720
                        creation_time: 1707012665747
                        modification_time: 1744706901976
                        detection_time: 1704757310414
                        starred: true
                        xdr_url: https://portal.acme-systems.org/0455da
                        rule_based_score: 942
                        manual_score: 174
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /incidents/get_incident_extra_data:
    post:
      operationId: getIncidentExtraData
      summary: Palo Alto Networks Get Incident Details
      description: Returns detailed information about a specific incident including all associated alerts, network artifacts, file artifacts, and endpoint details.
      tags:
      - Incidents
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - request_data
              properties:
                request_data:
                  type: object
                  required:
                  - incident_id
                  properties:
                    incident_id:
                      type: string
                      description: Unique identifier of the incident.
                    alerts_limit:
                      type: integer
                      description: Maximum number of alerts to include in response.
                      default: 1000
            examples:
              GetIncidentExtraDataRequestExample:
                summary: Default getIncidentExtraData request
                x-microcks-default: true
                value:
                  request_data:
                    incident_id: '709824'
                    alerts_limit: 1000
      responses:
        '200':
          description: Incident details returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      incident:
                        $ref: '#/components/schemas/IncidentDetail'
                      alerts:
                        type: object
                        properties:
                          total_count:
                            type: integer
                          data:
                            type: array
                            items:
                              $ref: '#/components/schemas/Alert'
                      network_artifacts:
                        type: object
                      file_artifacts:
                        type: object
              examples:
                GetIncidentExtraData200Example:
                  summary: Default getIncidentExtraData 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      incident: example-incident
                      alerts:
                        total_count: 428
                        data:
                        - alert_id: '999423'
                          detection_timestamp: 1733555086833
                          name: Staging Policy 70
                          category: custom
                          description: Rule incident incident firewall suspicious monitoring activity threat rule monitoring suspicious detected.
                          host_ip:
                          - example-host_ip_item
                          - example-host_ip_item
                          host_name: Corporate Agent 14
                          user_name: jsmith
                          mac:
                          - example-mac_item
                          source: example-source
                          action: alert
                          action_pretty: alert
                          severity: informational
                          matching_status: running
                          alert_type: standard
                          resolution_status: enabled
                          resolution_comment: Monitoring threat applied Security investigation Security configured.
                      network_artifacts: {}
                      file_artifacts: {}
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /incidents/update_incident:
    post:
      operationId: updateIncident
      summary: Palo Alto Networks Update Incident
      description: Updates the status, severity, assignee, or other mutable fields of a specific incident. Only the fields provided in the request body are modified.
      tags:
      - Incidents
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - request_data
              properties:
                request_data:
                  type: object
                  required:
                  - incident_id
                  properties:
                    incident_id:
                      type: string
                    status:
                      type: string
                      enum:
                      - new
                      - under_investigation
                      - resolved_threat_handled
                      - resolved_known_issue
                      - resolved_duplicate
                      - resolved_false_positive
                      - resolved_other
                    severity:
                      type: string
                      enum:
                      - high
                      - medium
                      - low
                    assigned_user_mail:
                      type: string
                      description: Email of the user to assign the incident to.
                    assigned_user_pretty_name:
                      type: string
                    resolve_comment:
                      type: string
                      description: Resolution comment (required when closing an incident).
                    add_comment:
                      type: string
                      description: Comment to add to the incident timeline.
            examples:
              UpdateIncidentRequestExample:
                summary: Default updateIncident request
                x-microcks-default: true
                value:
                  request_data:
                    incident_id: '498189'
                    status: resolved_duplicate
                    severity: high
                    assigned_user_mail: security-ops@example.com
                    assigned_user_pretty_name: Jane Garcia
                    resolve_comment: Detected endpoint configured policy firewall Security malware rule suspicious alert incident network.
                    add_comment: Endpoint detected suspicious incident network firewall threat malware configured blocked alert investigation.
      responses:
        '200':
          description: Incident updated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: boolean
              examples:
                UpdateIncident200Example:
                  summary: Default updateIncident 200 response
                  x-microcks-default: true
                  value:
                    reply: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /incident_management/get_incidents:
    post:
      operationId: getIncidents
      summary: Palo Alto Networks Get Attack Surface Incidents
      description: Returns a list of attack surface incidents. Xpanse incidents represent confirmed exposures that require remediation such as unintended services, misconfigured certificates, or shadow IT. Supports filtering by status, severity, type, and assignee.
      tags:
      - Incidents
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                request_data:
                  type: object
                  properties:
                    filters:
                      type: array
                      items:
                        $ref: '#/components/schemas/Filter_2'
                    search_from:
                      type: integer
                      default: 0
                    search_to:
                      type: integer
                      default: 100
                    sort:
                      $ref: '#/components/schemas/SortOrder_2'
            examples:
              GetIncidentsRequestExample:
                summary: Default getIncidents request
                x-microcks-default: true
                value:
                  request_data:
                    filters:
                    - field: example-field
                      operator: contains
                      value: example-value
                    - field: example-field
                      operator: contains
                      value: example-value
                    search_from: 0
                    search_to: 100
                    sort:
                      field: example-field
                      keyword: asc
      responses:
        '200':
          description: Attack surface incidents returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: object
                    properties:
                      total_count:
                        type: integer
                      result_count:
                        type: integer
                      incidents:
                        type: array
                        items:
                          $ref: '#/components/schemas/AsmIncident'
              examples:
                GetIncidents200Example:
                  summary: Default getIncidents 200 response
                  x-microcks-default: true
                  value:
                    reply:
                      total_count: 723
                      result_count: 282
                      incidents:
                      - incident_id: '593269'
                        incident_name: Production Agent 40
                        status: resolved_no_risk
                        severity: informational
                        incident_type: &id001
                        - standard
                        assigned_user_mail: analyst1@example.com
                        assigned_user_pretty_name: John Smith
                        alert_count: 939
                        description: Alert threat detected Security incident monitoring activity incident.
                        creation_time: 1704469877477
                        modification_time: 1740534005374
                        resolved_by: example-resolved_by
                        resolve_comment: Rule on firewall violation traffic violation Security detected.
                        tags: &id002
                        - key: example-key
                          value: example-value
                      - incident_id: '593269'
                        incident_name: Production Agent 40
                        status: resolved_no_risk
                        severity: informational
                        incident_type: *id001
                        assigned_user_mail: analyst1@example.com
                        assigned_user_pretty_name: John Smith
                        alert_count: 939
                        description: Alert threat detected Security incident monitoring activity incident.
                        creation_time: 1704469877477
                        modification_time: 1740534005374
                        resolved_by: example-resolved_by
                        resolve_comment: Rule on firewall violation traffic violation Security detected.
                        tags: *id002
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden_2'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /incident_management/update_incident:
    post:
      operationId: updateIncident
      summary: Palo Alto Networks Update Attack Surface Incident
      description: Updates the status, assignee, severity, or resolution details of an attack surface incident. Use this endpoint to track remediation progress and close incidents after the exposure has been addressed.
      tags:
      - Incidents
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - request_data
              properties:
                request_data:
                  type: object
                  required:
                  - incident_id
                  properties:
                    incident_id:
                      type: string
                      description: Unique identifier of the attack surface incident.
                    status:
                      type: string
                      enum:
                      - new
                      - under_investigation
                      - resolved
                      - resolved_no_risk
                      - resolved_risk_accepted
                      - resolved_contested_asset
                      - resolved_remediated_automatically
                    assigned_user_mail:
                      type: string
                      description: Email of the user to assign the incident to.
                    assigned_user_pretty_name:
                      type: string
                    severity:
                      type: string
                      enum:
                      - critical
                      - high
                      - medium
                      - low
                      - informational
                    resolve_comment:
                      type: string
                      description: Resolution comment when closing an incident.
                    comment:
                      type: string
                      description: Comment to add to the incident.
            examples:
              UpdateIncidentRequestExample:
                summary: Default updateIncident request
                x-microcks-default: true
                value:
                  request_data:
                    incident_id: '742866'
                    status: resolved_no_risk
                    assigned_user_mail: analyst1@example.com
                    assigned_user_pretty_name: John Kumar
                    severity: low
                    resolve_comment: Endpoint incident malware on configured on incident policy endpoint.
                    comment: Security incident rule malware suspicious detected incident traffic violation configured.
      responses:
        '200':
          description: Attack surface incident updated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  reply:
                    type: boolean
              examples:
                UpdateIncident200Example:
                  summary: Default updateIncident 200 response
                  x-microcks-default: true
                  value:
                    reply: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /incident:
    post:
      operationId: createIncident
      summary: Palo Alto Networks Create Incident
      description: Creates a new incident in Cortex XSOAR. Incidents represent security events requiring investigation and response. Specify the incident type, severity, name, and any custom fields defined for the incident type. If an associated playbook is configured for the incident type, it starts automatically.
      tags:
      - Incidents
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIncidentRequest'
            examples:
              CreateIncidentRequestExample:
                summary: Default createIncident request
                x-microcks-default: true
                value:
                  name: Corporate Gateway 34
                  type: custom
                  severity: 2
                  owner: example-owner
                  occurred: '2025-12-19T01:48:14Z'
                  details: Traffic rule network firewall endpoint incident network incident configured firewall activity.
                  labels:
                  - type: advanced
                    value: example-value
                  createInvestigation: true
                  CustomFields: {}
                  rawJson: example-rawJson
      responses:
        '200':
          description: Incident created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Incident_3'
              examples:
                CreateIncident200Example:
                  summary: Default createIncident 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Firewall 02
                    type: custom
                    status: 2
                    severity: 5
                    owner: example-owner
                    created: '2026-04-27T13:10:38Z'
                    modified: '2026-02-28T09:07:32Z'
                    occurred: '2026-07-07T08:02:17Z'
                    closed: '2025-06-22T23:38:50Z'
                    closeReason: example-closeReason
                    closeNotes: Malware firewall on activity applied investigation suspicious detected activity.
                    labels:
                    - type: custom
                      value: example-value
                    details: Suspicious firewall detected configured suspicious network detected blocked suspicious.
                    investigationId: '720788'
                    playbookId: '265379'
                    sourceInstance: example-sourceInstance
                    sourceBrand: example-sourceBrand
                    rawJson: example-rawJson
                    CustomFields: {}
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /incidents/search:
    get:
      operationId: searchIncidentsGet
      summary: Palo Alto Networks Search Incidents (GET)
      description: Returns incidents matching query criteria specified as URL query parameters. Supports filtering by keyword, status, severity, type, and time range. For complex queries use POST /incidents/search.
      tags:
      - Incidents
      parameters:
      - name: query
        in: query
        description: Lucene query string to filter incidents (e.g., status:Active AND severity:High).
        schema:
          type: string
        example: example-query
      - name: size
        in: query
        description: Maximum number of incidents to return.
        schema:
          type: integer
          default: 10
          maximum: 100
        example: 10
      - name: fromdate
        in: query
        description: Filter incidents created after this date (ISO 8601 format).
        schema:
          type: string
          format: date-time
        example: '2025-09-17T20:14:07Z'
      - name: todate
        in: query
        description: Filter incidents created before this date (ISO 8601 format).
        schema:
          type: string
          format: date-time
        example: '2025-05-07T00:33:09Z'
      - name: page
        in: query
        description: Page number for pagination (zero-based).
        schema:
          type: integer
          default: 0
        example: 0
      responses:
        '200':
          description: Incidents returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentSearchResponse'
              examples:
                SearchIncidentsGet200Example:
                  summary: Default searchIncidentsGet 200 response
                  x-microcks-default: true
                  value:
                    total:
                      value: 316
                      relation: example-relation
                    incidents:
                    - id: example-id
                      name: Branch Firewall 02
                      type: custom
                      status: 2
                      severity: 5
                      owner: example-owner
                      created: '2026-04-27T13:10:38Z'
                      modified: '2026-02-28T09:07:32Z'
                      occurred: '2026-07-07T08:02:17Z'
                      closed: '2025-06-22T23:38:50Z'
                      closeReason: example-closeReason
                      closeNotes: Malware firewall on activity applied investigation suspicious detected activity.
                      labels:
                      - type: custom
                        value: example-value
                      details: Suspicious firewall detected configured suspicious network detected blocked suspicious.
                      investigationId: '720788'
                      playbookId: '265379'
                      sourceInstance: example-sourceInstance
                      sourceBrand: example-sourceBrand
                      rawJson: example-rawJson
                      CustomFields: {}
                    searchResultTotal: 847
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: searchIncidentsPost
      summary: Palo Alto Networks Search Incidents (POST)
      description: Searches for incidents using a structured filter in the request body. Supports advanced filtering, field selection, sorting, and pagination. Preferred over GET for complex queries.
      tags:
      - Incidents
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentSearchRequest'
            examples:
              SearchIncidentsPostRequestExample:
                summary: Default searchIncidentsPost request
                x-microcks-default: true
                value:
                  filter:
                    query: example-query
                    status:
                    - 427
                    sort:
                    - field: example-field
                      asc: true
                    period:
                      byFrom: '2026-11-24T23:01:39Z'
                      byTo: '2025-06-05T03:13:28Z'
                  fromDate: '2025-04-24T04:56:15Z'
                  toDate: '2024-07-10T05:59:35Z'
                  size: 10
                  page: 0
      responses:
        '200':
          description: Incidents returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentSearchResponse'
              examples:
                SearchIncidentsPost200Example:
                  summary: Default searchIncidentsPost 200 response
                  x-microcks-default: true
                  value:
                    total:
                      value: 316
                      relation: example-relation
                    incidents:
                    - id: example-id
                      name: Branch Firewall 02
                      type: custom
                      status: 2
                      severity: 5
                      owner: example-owner
                      created: '2026-04-27T13:10:38Z'
                      modified: '2026-02-28T09:07:32Z'
                      occurred: '2026-07-07T08:02:17Z'
                      closed: '2025-06-22T23:38:50Z'
                      closeReason: example-closeReason
                      closeNotes: Malware firewall on activity applied investigation suspicious detected activity.
                      labels:
                      - type: custom
                        value: example-value
                      details: Suspicious firewall detected configured suspicious network detected blocked suspicious.
                      investigationId: '720788'
                      playbookId: '265379'
                      sourceInstance: example-sourceInstance
                      sourceBrand: example-sourceBrand
                      rawJson: example-rawJson
                      CustomFields: {}
                    searchResultTotal: 847
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /incident/{id}:
    get:
      operationId: getIncident
      summary: Palo Alto Networks Get Incident
      description: Returns a specific incident by its unique identifier, including all fields and metadata.
      tags:
      - Incidents
      parameters:
      - $ref: '#/components/parameters/incidentId'
      responses:
        '200':
          description: Incident returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Incident_3'
              examples:
                GetIncident200Example:
                  summary: Default getIncident 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Firewall 02
                    type: custom
                    status: 2
                    severity: 5
                    owner: example-owner
                    created: '2026-04-27T13:10:38Z'
                    modified: '2026-02-28T09:07:32Z'
                    occurred: '2026-07-07T08:02:17Z'
                    closed: '2025-06-22T23:38:50Z'
                    closeReason: example-closeReason
                    closeNotes: Malware firewall on activity applied investigation suspicious detected activity.
                    labels:
                    - type: custom
                      value: example-value
                    details: Suspicious firewall detected configured suspicious network detected blocked suspicious.
                    investigationId: '720788'
                    playbookId: '265379'
                    sourceInstance: example-sourceInstance
                    sourceBrand: example-sourceBrand
      

# --- truncated at 32 KB (109 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-incidents-api-openapi.yml