Palo Alto Networks · Example Payload

Cortex Xsoar Api Investigation Example

Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR

Cortex Xsoar Api Investigation Example is an example object payload from Palo Alto Networks, with 9 top-level fields. It illustrates the shape of data this provider's APIs accept or return.

Top-level fields

idnamestatusincidentIdcreatedmodifiedentriesplaybookIdrunningPlaybooks

Example Payload

{
  "id": "example-id",
  "name": "Production Agent 72",
  "status": 407,
  "incidentId": "191656",
  "created": "2026-09-23T22:42:53Z",
  "modified": "2026-07-09T02:16:45Z",
  "entries": [
    {
      "id": "example-id",
      "investigationId": "528514",
      "type": 189,
      "user": "jsmith",
      "created": "2025-08-27T16:48:48Z",
      "modified": "2024-02-06T10:46:42Z",
      "contents": "Activity activity allowed configured analysis suspicious security for.",
      "humanReadable": "example-humanReadable",
      "tags": [
        "pci-scope",
        "critical-asset",
        "monitored"
      ]
    },
    {
      "id": "example-id",
      "investigationId": "144989",
      "type": 140,
      "user": "admin",
      "created": "2024-10-05T00:52:53Z",
      "modified": "2024-12-14T22:56:20Z",
      "contents": "Endpoint endpoint for on network monitoring configured alert response investigation configured incident.",
      "humanReadable": "example-humanReadable",
      "tags": [
        "production",
        "critical-asset"
      ]
    },
    {
      "id": "example-id",
      "investigationId": "351343",
      "type": 606,
      "user": "soc-analyst",
      "created": "2025-12-09T15:34:25Z",
      "modified": "2026-05-21T19:14:10Z",
      "contents": "And response firewall suspicious activity updated network and malware and applied under endpoint and incident detected monitoring on and.",
      "humanReadable": "example-humanReadable",
      "tags": [
        "monitored",
        "critical-asset",
        "pci-scope"
      ]
    }
  ],
  "playbookId": "138058",
  "runningPlaybooks": [
    "example-runningPlaybooks_item"
  ]
}