Palo Alto Networks · Example Payload

Cortex Xsiam Api Incident Example

Blocked updated alert security monitoring threat detected applied on rule alert applied response.

Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR

Cortex Xsiam Api Incident Example is an example object payload from Palo Alto Networks, with 15 top-level fields. It illustrates the shape of data this provider's APIs accept or return.

Top-level fields

incident_idincident_namedescriptionstatusseverityassigned_user_mailassigned_user_pretty_namealert_countcreation_timemodification_timedetection_timestarredxdr_urlmitre_tactics_ids_and_namesmitre_techniques_ids_and_names

Example Payload

Raw ↑ 
{
  "incident_id": "222977",
  "incident_name": "Production Cluster 61",
  "description": "Blocked updated alert security monitoring threat detected applied on rule alert applied response.",
  "status": "resolved_duplicate",
  "severity": "high",
  "assigned_user_mail": "jane.doe@example.com",
  "assigned_user_pretty_name": "Jane Doe",
  "alert_count": 596,
  "creation_time": 1702877063165,
  "modification_time": 1725514126517,
  "detection_time": 1716551809855,
  "starred": false,
  "xdr_url": "https://login.enterprise.local/path/df8f13",
  "mitre_tactics_ids_and_names": [
    "586752",
    "275523"
  ],
  "mitre_techniques_ids_and_names": [
    "559090"
  ]
}