Palo Alto Networks · Example Payload

Cortex Xsoar Api Incident Search Response Example

Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR

Cortex Xsoar Api Incident Search Response Example is an example object payload from Palo Alto Networks, with 3 top-level fields. It illustrates the shape of data this provider's APIs accept or return.

Top-level fields

totalincidentssearchResultTotal

Example Payload

Raw ↑ 
{
  "total": {
    "value": 88,
    "relation": "example-relation"
  },
  "incidents": [
    {
      "id": "example-id",
      "name": "Secondary Gateway 22",
      "type": "advanced",
      "status": 3,
      "severity": 2,
      "owner": "example-owner",
      "created": "2026-09-19T02:35:23Z",
      "modified": "2024-01-09T21:53:31Z",
      "occurred": "2026-07-16T12:00:05Z",
      "closed": "2025-09-15T06:40:46Z",
      "closeReason": "Applied alert threat suspicious malware response analysis malware.",
      "closeNotes": "Blocked detected detected detected on for.",
      "labels": [
        {
          "type": "standard",
          "value": "example-value"
        },
        {
          "type": "standard",
          "value": "example-value"
        },
        {
          "type": "standard",
          "value": "example-value"
        }
      ],
      "details": "And traffic traffic firewall traffic traffic blocked on on traffic and for.",
      "investigationId": "307946",
      "playbookId": "988938",
      "sourceInstance": "example-sourceInstance",
      "sourceBrand": "example-sourceBrand",
      "rawJson": "example-rawJson",
      "CustomFields": {}
    },
    {
      "id": "example-id",
      "name": "Secondary Firewall 69",
      "type": "standard",
      "status": 1,
      "severity": 3,
      "owner": "example-owner",
      "created": "2024-03-01T17:23:39Z",
      "modified": "2024-09-20T01:53:13Z",
      "occurred": "2024-10-11T21:50:56Z",
      "closed": "2025-10-13T13:00:33Z",
      "closeReason": "Violation traffic detected incident suspicious activity policy blocked.",
      "closeNotes": "Incident suspicious analysis applied threat incident analysis network blocked.",
      "labels": [
        {
          "type": "standard",
          "value": "example-value"
        },
        {
          "type": "default",
          "value": "example-value"
        }
      ],
      "details": "Blocked response allowed endpoint monitoring malware allowed.",
      "investigationId": "529105",
      "playbookId": "996987",
      "sourceInstance": "example-sourceInstance",
      "sourceBrand": "example-sourceBrand",
      "rawJson": "example-rawJson",
      "CustomFields": {}
    },
    {
      "id": "example-id",
      "name": "Staging Agent 61",
      "type": "default",
      "status": 1,
      "severity": 3,
      "owner": "example-owner",
      "created": "2026-08-24T07:11:45Z",
      "modified": "2024-12-02T22:52:22Z",
      "occurred": "2026-11-10T00:12:45Z",
      "closed": "2026-11-20T21:58:45Z",
      "closeReason": "Analysis configured alert updated monitoring analysis.",
      "closeNotes": "On violation analysis incident threat traffic for rule detected violation rule rule firewall.",
      "labels": [
        {
          "type": "advanced",
          "value": "example-value"
        }
      ],
      "details": "Security activity threat applied updated applied threat incident applied allowed.",
      "investigationId": "102371",
      "playbookId": "869111",
      "sourceInstance": "example-sourceInstance",
      "sourceBrand": "example-sourceBrand",
      "rawJson": "example-rawJson",
      "CustomFields": {}
    }
  ],
  "searchResultTotal": 156
}