AlertPayload

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "AlertPayload",
  "description": "The payload delivered to the webhook endpoint for Cortex XDR alert creation events. Contains alert identification, incident association, timing metadata, status, severity, alert aggregation counts, assignee information, description, and contributing data sources.\n",
  "$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/json-schema/cortex-xdr-webhooks-alert-payload-schema.json",
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Human-readable name of the alert derived from the detection rule, analytics model, IOC match, or BIOC rule that triggered it.\n",
      "example": "Malicious Process Execution - Mimikatz"
    },
    "incident_id": {
      "type": "string",
      "description": "The unique identifier of the parent incident to which this alert has been correlated. Enables association of individual alerts with their incident context.\n",
      "example": "5001"
    },
    "creation_time": {
      "type": "integer",
      "description": "Unix epoch timestamp in milliseconds indicating when the alert was first generated by the detecting engine or agent.\n",
      "example": 1705312200000
    },
    "modification_time": {
      "type": "integer",
      "description": "Unix epoch timestamp in milliseconds indicating the most recent modification to the alert record.\n",
      "example": 1705312200000
    },
    "status": {
      "type": "string",
      "description": "The current status of the alert at the time this webhook notification was dispatched.\n",
      "enum": [
        "new",
        "under_investigation",
        "resolved_threat_handled",
        "resolved_known_issue",
        "resolved_duplicate",
        "resolved_false_positive",
        "resolved_auto"
      ],
      "example": "new"
    },
    "severity": {
      "type": "string",
      "description": "The severity level of the individual alert as determined by the detection rule, analytics model, or IOC threat intelligence that triggered it.\n",
      "enum": [
        "low",
        "medium",
        "high",
        "critical"
      ],
      "example": "high"
    },
    "alert_count": {
      "type": "integer",
      "description": "The number of raw detection events aggregated into this alert. Multiple occurrences of the same detection within a time window may be consolidated into a single alert record.\n",
      "minimum": 1,
      "example": 1
    },
    "assigned_user_mail": {
      "type": "string",
      "description": "The email address of the analyst assigned to investigate the parent incident of this alert. Empty string when unassigned.\n",
      "format": "email",
      "example": ""
    },
    "description": {
      "type": "string",
      "description": "A detailed description of the alert providing context about the detected malicious or suspicious activity, including process details, file paths, network connections, or user context.\n",
      "example": "Mimikatz credential dumping tool execution detected on WORKSTATION-042 under user context DOMAIN\\jsmith"
    },
    "alert_sources": {
      "type": "array",
      "description": "List of detection source identifiers that contributed to this alert. Identifies which Cortex XDR engine or module produced the detection.\n",
      "items": {
        "type": "string",
        "description": "Name of the detection source (e.g., XDR Agent, XDR Analytics, XDR Analytics BIOC, XDR BIOC, Cortex XDR - IOC).\n"
      },
      "example": [
        "XDR Agent"
      ]
    }
  },
  "required": [
    "name",
    "incident_id",
    "creation_time",
    "modification_time",
    "status",
    "severity",
    "alert_count",
    "alert_sources"
  ]
}