{ "openapi": "3.0.0", "x-hideTryItPanel": true, "info": { "version": "Cortex Cloud", "title": "Issues API", "description": "Use the Cortex Cloud Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata. The license requirements for each API are listed individually.", "contact": { "email": "docs-cortex@paloaltonetworks.com", "name": "Cortex Documentation Team", "url": "https://cortex-docs.paloaltonetworks.com/" } }, "servers": [ { "url": "https://api-yourfqdn" } ], "security": [], "tags": [ { "name": "Issues", "description": "Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata." } ], "paths": { "/public_api/v1/issue": { "post": { "summary": "Create a new issue", "description": "This endpoint allows users to create a new issue by providing the necessary details. \n**Users can only create one issue at a time.**\n- The request must include the following required fields:\n - `name`\n - `description`\n - `observation_time`\n - `issue_domain`\n - `category`\n - `severity`\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management", "operationId": "createIssue", "parameters": [ { "name": "Authorization", "in": "header", "description": "{api_key}", "required": true, "schema": { "type": "string" } }, { "name": "x-xdr-auth-id", "in": "header", "description": "{api_key_id}", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "issue": { "$ref": "#/components/schemas/CreateIssue" } } } } }, "examples": { "create_basic_issue": { "summary": "Create a basic issue with required fields", "value": { "request_data": { "issue": { "name": "Unauthorized Access Detected", "description": "An unauthorized login attempt was detected from an unknown IP address.", "observation_time": 1700000000000, "issue_domain": "Security", "category": "CONFIGURATION", "severity": "HIGH" } } } }, "create_full_issue": { "summary": "Create an issue with all optional fields", "value": { "request_data": { "issue": { "name": "Publicly Exposed Database", "description": "PostgreSQL database instance is publicly accessible on port 5432.", "observation_time": 1700000000000, "issue_domain": "Posture", "category": "CONFIGURATION", "severity": "CRITICAL", "owner": "CWP", "type": "Posture", "remediation": "Restrict database access to private subnets only.", "impact": "Potential unauthorized access to sensitive data.", "extended_description": "The database instance has a security group allowing inbound traffic from 0.0.0.0/0 on port 5432.", "initial_evidence": "Security group sg-12345 allows inbound TCP/5432 from 0.0.0.0/0", "asset_ids": [ "asset-db-001" ], "mitre_tactics": [ "TA0001" ], "mitre_techniques": [ "T1190" ], "tags": [ "critical", "database", "public-access" ], "assigned_to": "security_team_lead", "assigned_to_pretty": "Alice Smith", "is_starred": true, "is_excluded": false } } } } } } } }, "responses": { "202": { "description": "Issue created successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "external_id": { "type": "string" }, "detection_method": { "type": "string" } } }, "example": { "external_id": "7c96737d50f74c7b9487450426e9eafb", "detection_method": "CREATE_ALERT_PUBLIC_API" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } }, "tags": [ "Issues" ] } }, "/public_api/v1/issue/search": { "post": { "summary": "Retrieve issues based on filters", "description": "This endpoint retrieves a list of issues that match the specified filter criteria. It supports filtering, sorting, and pagination.\n\nSee the [Supported Filter Fields & Values](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/issues-apis/issues-papi-tables#supported-filter-fields-values)\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management", "operationId": "getIssues", "parameters": [ { "name": "Authorization", "in": "header", "description": "{api_key}", "required": true, "schema": { "type": "string" } }, { "name": "x-xdr-auth-id", "in": "header", "description": "{api_key_id}", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "filters": { "type": "array", "items": { "type": "object", "properties": { "field": { "type": "string", "enum": [ "id", "external_id", "detection.method", "issue_domain", "severity", "_insert_time", "last_modified", "status.progress", "assigned_to", "assigned_to_pretty", "observation_time", "category", "detection.rule_id", "asset_ids", "asset_names", "asset_classes", "asset_group_ids", "asset_categories", "asset_regions", "asset_providers", "asset_accounts", "asset_types", "asset_external_provider_ids", "asset_cloud_account_names", "xdm.compliance.standard_id", "xdm.compliance.category_id", "xdm.compliance.control_id", "xdm.policy_id", "asset_group_names", "asset_tags" ], "description": "Specifies the field to filter issues by. See the endpoint description above for allowed values per field." }, "operator": { "type": "string", "enum": [ "in", "gte", "lte" ], "description": "Comparison operator to use with the filter. Note: `gte` and `lte` are only valid for time-based fields (`_insert_time`, `last_modified`, `observation_time`). All other fields support `in`." }, "value": { "oneOf": [ { "type": "array", "items": { "type": "integer" } }, { "type": "array", "items": { "type": "string" } }, { "type": "integer" }, { "type": "string" } ], "description": "Value(s) for filtering the issues. Allowed values depend on the selected field:\n\n- **severity**: `INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`\n- **status.progress**: `New`, `In Progress`, `Resolved`\n- **issue_domain**: `Security`, `Health`, `Hunting`, `IT`, `Posture` (custom domains may also be configured)\n- **detection.method**: `XDR Agent`, `XDR Analytics`, `PAN NGFW`, `XDR BIOC`, `XDR IOC`, `Threat Intelligence`, `XDR Managed Threat Hunting`, `XDR Analytics BIOC`, `Correlation`, `Prisma Cloud`, `Prisma Cloud Compute`, `ASM`, `IoT Security`, `Custom Issue`, `Health`, `SaaS Attachments`, `Attack Path`, `Posture Policy`, `CAS Drift Scanner`, `Cloud Network Analyzer`, `IaC Scanner`, `CAS Secret Scanner`, `CI/CD Risks`, `CLI Scanner`, `CIEM Scanner`, `API Traffic Monitor`, `API Posture Scanner`, `Agentless Disk Scanner`, `Kubernetes Scanner`, `Compute Policy`, `CSPM Scanner`, `CAS CVE Scanner`, `CAS License Scanner`, `Secrets Scanner`, `SAST Scanner`, `Data Policy`, `Package Operational Risk`, `Vulnerability Policy`, `AI Security Posture`, `DLP`, `MIRRORING`, `AURL`, `User Reported Phishing`, `Graph Engine`\n- **category**: `CONFIGURATION`, `VULNERABILITY`, `MALWARE`, `IDENTITY`, `NETWORK`, `DATA_LOSS`, `COMPLIANCE`, `RUNTIME`, `SECRETS`, `IAC`, `CI_CD_RISKS`, `DRIFT`, `API_SECURITY`, `POSTURE`, `COMPUTE`, `LICENSE`, `OPERATIONAL_RISK`, `AI_SECURITY`\n- **asset_classes**: `Compute`, `Data`, `Network`, `Identity`, `Security`, `Management`, `Application`, `Other`\n- **asset_categories**: `Storage Bucket`, `Virtual Machine`, `Database Instance`, `Container`, `Serverless Function`, `Load Balancer`, `Firewall`, `VPN Gateway`, `IAM Role`, `IAM User`, `IAM Group`, `IAM Policy`, `Service Account`, `Kubernetes Cluster`, `Kubernetes Pod`, `Kubernetes Node`, `Network Interface`, `Subnet`, `VPC`, `Security Group`, `DNS Zone`, `Certificate`, `Key Vault`, `Disk`, `Snapshot`, `Image`, `Queue`, `Topic`, `API Gateway`, `CDN`, `Other`\n- **asset_providers**: `AWS`, `Azure`, `GCP`, `Oracle Cloud`, `IBM Cloud`, `Alibaba Cloud`, `Other`\n- **_insert_time, last_modified, observation_time**: Epoch timestamp in milliseconds (integer)\n- **id**: Integer issue ID\n- **external_id, detection.rule_id, assigned_to, assigned_to_pretty, asset_ids, asset_names, asset_accounts, asset_regions, asset_types, asset_group_ids, asset_external_provider_ids, asset_cloud_account_names**: Free-text string values\n- **xdm.compliance.standard_id, xdm.compliance.category_id, xdm.compliance.control_id**: Compliance framework identifiers (string)\n- **xdm.policy_id**: Policy identifier (string)\n- **asset_group_names**: Asset group names (string)\n- **asset_tags**: Asset tag values (string)" } } } }, "search_from": { "type": "integer", "default": 0, "description": "Starting index for pagination." }, "search_to": { "type": "integer", "default": 100, "description": "Ending index for pagination." }, "sort": { "type": "object", "properties": { "field": { "type": "string", "enum": [ "id", "severity", "observation_time" ] }, "keyword": { "type": "string", "enum": [ "asc", "desc" ], "description": "Sort order (ascending or descending)." } } }, "include_fields": { "type": "array", "items": { "type": "string", "enum": [ "normalized_fields", "custom_fields" ] }, "description": "A list of fields to include in the response.\n- `normalized_fields`: Includes normalized fields in the response.\n- `custom_fields`: Includes custom user-defined fields in the response.\n- By default these fields will not be part of response payload.\n", "default": [] }, "include_evidences": { "type": "boolean", "default": false, "description": "When `true`, each issue includes its `evidences` array." }, "include_actions": { "type": "boolean", "default": false, "description": "When `true`, each issue includes its `actions` array." } } } } }, "examples": { "search_by_severity": { "summary": "Search issues by severity", "value": { "request_data": { "filters": [ { "field": "severity", "operator": "in", "value": [ "HIGH", "CRITICAL" ] } ], "search_from": 0, "search_to": 50, "sort": { "field": "observation_time", "keyword": "desc" } } } }, "search_by_time_range": { "summary": "Search issues by time range", "value": { "request_data": { "filters": [ { "field": "_insert_time", "operator": "gte", "value": 1700000000000 }, { "field": "_insert_time", "operator": "lte", "value": 1700100000000 } ], "search_from": 0, "search_to": 100 } } }, "search_by_status_and_domain": { "summary": "Search issues by status and domain", "value": { "request_data": { "filters": [ { "field": "status.progress", "operator": "in", "value": [ "New" ] }, { "field": "issue_domain", "operator": "in", "value": [ "Security" ] } ], "search_from": 0, "search_to": 100, "include_fields": [ "normalized_fields", "custom_fields" ] } } }, "search_by_issue_id": { "summary": "Search issues by issue ID", "value": { "request_data": { "filters": [ { "field": "id", "operator": "in", "value": [ 123, 456, 789 ] } ] } } }, "search_by_detection_method": { "summary": "Search issues by detection method", "value": { "request_data": { "filters": [ { "field": "detection.method", "operator": "in", "value": [ "CSPM_SCANNER", "CREATE_ALERT_PUBLIC_API" ] } ], "sort": { "field": "severity", "keyword": "desc" } } } }, "search_by_assets": { "summary": "Search issues by asset names and accounts", "value": { "request_data": { "filters": [ { "field": "asset_names", "operator": "in", "value": [ "my-server-01", "my-database-prod" ] }, { "field": "asset_accounts", "operator": "in", "value": [ "883588134481" ] } ] } } } } } } }, "responses": { "200": { "description": "Successful response with issues", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "TOTAL_COUNT": { "type": "integer" }, "FILTER_COUNT": { "type": "integer" }, "DATA": { "type": "array", "items": { "$ref": "#/components/schemas/Issue" } } } } } }, "example": { "reply": { "TOTAL_COUNT": 1500, "FILTER_COUNT": 2, "DATA": [ { "_insert_time": 1705312200000, "external_id": "abc-12345-def", "name": "Publicly Exposed Storage Bucket", "description": "S3 bucket my-data-bucket is publicly accessible", "observation_time": 1705312200000, "domain": "Posture", "detection.method": "CSPM_SCANNER", "detection.rule_id": "RULE-S3-PUBLIC", "category": "CONFIGURATION", "findings": [ "f1a2b3c4d5" ], "asset_ids": [ "a8d24e796ef264a33e6e84c707ff2f67" ], "asset_names": [ "my-data-bucket" ], "asset_group_ids": [ 5, 42 ], "asset_classes": [ "Data" ], "asset_categories": [ "Storage Bucket" ], "asset_regions": [ "us-east-1" ], "asset_providers": [ "AWS" ], "asset_accounts": [ "883588134481" ], "asset_types": [ "S3 Bucket" ], "mitre_tactics": [ "TA0001 - Initial Access" ], "mitre_techniques": [ "T1190 - Exploit Public-Facing Application" ], "type": "Posture", "remediation": "Restrict public access on the S3 bucket", "extended_description": "The bucket allows unauthenticated read access to all objects.", "impact": "Potential data exposure of sensitive customer records", "id": 12345, "last_update_timestamp": 1705315800000, "tags": [ "critical", "data-exposure" ], "is_excluded": false, "is_starred": true, "assigned_to": "alice.smith@example.com", "assigned_to_pretty": "Alice Smith", "status.progress": "New", "severity": "HIGH", "case_ids": [ 834 ], "is_excepted": false, "exception_ids": null, "exception_expiration": null, "initial_evidence": "Security group sg-12345 allows inbound TCP/5432 from 0.0.0.0/0", "asset_external_provider_ids": [], "asset_cloud_account_names": [], "action_status": "SCANNED", "agentic_response_status": null, "agentic_assistant_id": null, "agentic_response_conversation_id": null } ] } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } }, "tags": [ "Issues" ] } }, "/public_api/v1/issue/{issue-id}": { "post": { "summary": "Update existing issue", "description": "Update an existing issue in the system. **Users can only update one issue at a time.** \nAt least one of the following fields must be provided: \n - `severity`\n - `status`\n\nWhen setting `status` to `Resolved`, the `status_resolution_reason` field is **required**.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management", "operationId": "updateIssue", "parameters": [ { "name": "issue-id", "in": "path", "description": "Numeric ID of the issue to update", "required": true, "schema": { "type": "integer" } }, { "name": "Authorization", "in": "header", "description": "{api_key}", "required": true, "schema": { "type": "string" } }, { "name": "x-xdr-auth-id", "in": "header", "description": "{api_key_id}", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "update_data": { "$ref": "#/components/schemas/UpdateIssue" } } } } }, "examples": { "update_severity_only": { "summary": "Update issue severity", "value": { "request_data": { "update_data": { "severity": "CRITICAL" } } } }, "update_status_to_in_progress": { "summary": "Update issue status to In Progress", "value": { "request_data": { "update_data": { "status": "In Progress" } } } }, "resolve_issue": { "summary": "Resolve an issue with resolution reason and comment", "value": { "request_data": { "update_data": { "status": "Resolved", "status_resolution_reason": "Resolved - False Positive", "status_resolution_comment": "Verified this is a false positive after investigation." } } } }, "update_severity_and_status": { "summary": "Update both severity and status", "value": { "request_data": { "update_data": { "severity": "HIGH", "status": "Resolved", "status_resolution_reason": "Resolved - Known Issue", "status_resolution_comment": "Known issue tracked in internal ticket." } } } } } } } }, "responses": { "204": { "description": "Issues updated successfully" }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } }, "tags": [ "Issues" ] } }, "/public_api/v1/issue/schema/": { "post": { "summary": "Retrieve issue schema", "description": "This endpoint retrieves the schema definition for issues, including core fields, normalized fields, and custom fields. Each field includes its name, pretty name, and data type.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management", "operationId": "getIssueSchema", "tags": [ "Issues" ], "responses": { "200": { "description": "Successful response with issue schema", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "DATA": { "type": "array", "items": { "$ref": "#/components/schemas/IssueSchemaField" } } } } } }, "example": { "reply": { "DATA": [ { "field_name": "_insert_time", "field_pretty_name": "Insert Time", "data_type": "TIMESTAMP" }, { "field_name": "xdm.issue.id", "field_pretty_name": "Issue Id", "data_type": "INT" }, { "field_name": "xdm.issue.name", "field_pretty_name": "Name", "data_type": "TEXT" }, { "field_name": "xdm.issue.is_starred", "field_pretty_name": "Is Starred", "data_type": "BOOLEAN" }, { "field_name": "xdm.vulnerability.cvss_score", "field_pretty_name": "CVSS Score", "data_type": "FLOAT" }, { "field_name": "xdm.source.host.os_family", "field_pretty_name": "Source Host OS Family", "data_type": "ENUM" }, { "field_name": "my_custom_field", "field_pretty_name": "My Custom Field", "data_type": "TEXT" } ] } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/public_api/v1/issue_exceptions/": { "post": { "summary": "Create a new issue exception", "description": "This endpoint allows users to create a new issue exception by providing the necessary details.\n**Users can only create one exception at a time.**\n- The request must include the following required fields:\n - `name`\n - `rule`\n - `justification_text`\n - `justification_category`\n - `expiration_ts`\n - `approver_email`\n\n- Optional fields:\n - `external_exception_id`\n\nIf the tenant has approval required enabled, the `approver_email` field is mandatory and the exception will be created with `Pending Status` status. Otherwise, the exception is `Self Approved` automatically.\n\nThe `requestor_name` and `requestor_email` fields are automatically populated from the API key context.\n\n**Required permission:** `Exception Management Admin View/Edit`, `Exception Approver Admin View/Edit`\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management\n\nFor the complete list of fields you can use as `SEARCH_FIELD` in the `rule` parameter, see [Issue exception supported fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/issues-apis/issues-papi-tables#supported-fields-for-issue-exception-filters).", "operationId": "createIssueException", "parameters": [ { "name": "Authorization", "in": "header", "description": "{api_key}", "required": true, "schema": { "type": "string" } }, { "name": "x-xdr-auth-id", "in": "header", "description": "{api_key_id}", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "$ref": "#/components/schemas/CreateIssueException" } } }, "examples": { "basic_issue_exception": { "summary": "Create basic issue exception", "value": { "request_data": { "name": "CVE-2024-1234 Exception for legacy hosts", "rule": "{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"cve_id\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":\"CVE-2024-1234\"}]}}", "justification_text": "Legacy hosts scheduled for decommission in Q2", "justification_category": "RISK_ACCEPTED", "approver_email": "security-lead@example.com", "expiration_ts": "2025-06-30" } } }, "exception_with_external_id": { "summary": "Create with external tracking ID", "value": { "request_data": { "name": "Compensating control for CVE-2024-5678", "external_exception_id": "JIRA-SEC-4567", "rule": "{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"cve_id\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":\"CVE-2024-5678\"}]}}", "justification_text": "WAF rule deployed as compensating control", "justification_category": "COMPENSATING_CONTROL", "approver_email": "security-lead@example.com", "expiration_ts": "2025-12-31T23:59:59Z" } } }, "self_approved_exception": { "summary": "Create self-approved exception (no approver required)", "value": { "request_data": { "name": "CVE-2024-1234 Exception for legacy hosts", "rule": "{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"cve_id\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":\"CVE-2024-1234\"}]}}", "justification_text": "Legacy hosts scheduled for decommission in Q2", "justification_category": "RISK_ACCEPTED", "expiration_ts": "2025-06-30" } } } } } } }, "responses": { "200": { "description": "Exception created successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "exception_id": { "type": "integer", "description": "ID of the newly created exception" } } } } }, "examples": { "default": { "value": { "reply": { "exception_id": 42 } } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } }, "tags": [ "Issues" ] } }, "/public_api/v1/issue_exceptions/disable/": { "post": { "summary": "Disable an issue exception", "description": "This endpoint allows users to disable an existing issue exception. This will trigger a reversion scan to restore matching issues that were previously suppressed by this exception. **A disabled exception cannot be reactivated.**\n\n**Required permission:** `Exception Management Admin View/Edit`, `Exception Approver Admin View/Edit`\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management", "operationId": "disableIssueException", "parameters": [ { "name": "Authorization", "in": "header", "description": "{api_key}", "required": true, "schema": { "type": "string" } }, { "name": "x-xdr-auth-id", "in": "header", "description": "{api_key_id}", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "exception_id" ], "properties": { "exception_id": { "type": "integer", "description": "ID of the issue exception to disable" } } } } }, "examples": { "default": { "value": { "request_data": { "exception_id": 26 } } } } } } }, "responses": { "200": { "description": "Exception disabled successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "rows_affected": { "type": "integer", "description": "Number of database rows affected" }, "status": { "type": "string", "description": "New status of the exception" } } } } }, "examples": { "default": { "value": { "reply": { "rows_affected": 1, "status": "DISABLED" } } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } }, "tags": [ "Issues" ] } }, "/public_api/v1/issue_exceptions/search/": { "post": { "summary": "Retrieve issue exceptions based on filters", "description": "This endpoint retrieves a list of issue exceptions that match the specified filter criteria. It supports filtering along with sorting and pagination. \n\n**Required permission:** `Exception Management Admin View`, `Exception Approver Admin View`\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management", "operationId": "searchIssueExceptions", "parameters": [ { "name": "Authorization", "in": "header", "description": "{api_key}", "required": true, "schema": { "type": "string" } }, { "name": "x-xdr-auth-id", "in": "header", "description": "{api_key_id}", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "filters": { "type": "object", "description": "Filter criteria using AND/OR structure. Each filter condition contains SEARCH_FIELD, SEARCH_TYPE, and SEARCH_VALUE.", "properties": { "SEARCH_FIELD": { "type": "string", "enum": [ "EXCEPTION_ID", "EXTERNAL_EXCEPTION_ID", "NAME", "STATUS", "EXPIRATION_TS", "IMPACTED_ISSUES_COUNT", "BACKWARD_SCAN_STATUS", "JUSTIFICATION_CATEGORY", "REQUESTOR_NAME", "APPROVER_NAME", "CREATED_TS", "APPROVAL_TS", "JUSTIFICATION_TEXT", "APPROVAL_JUSTIFICATION", "REQUESTOR_EMAIL", "APPROVER_EMAIL" ], "description": "String that identifies the exception field the filter is matching." }, "SEARCH_TYPE": { "type": "string", "enum": [ "EQ", "NEQ", "GTE", "LTE", "GT", "LT", "IN", "CONTAINS", "CONTAINS_NOT" ], "description": "Identifies the comparison operator to use for this filter. The following list shows which operators can be used for each filter field:\n\n- **EQ** / **NEQ** - use with all fields\n- **GTE** / **LTE** / **GT** / **LT** - use with `EXCEPTION_ID`, `EXPIRATION_TS`, `IMPACTED_ISSUES_COUNT`, `CREATED_TS`, `APPROVAL_TS`\n- **IN** - use with `EXCEPTION_ID`, `STATUS`, `BACKWARD_SCAN_STATUS`, `JUSTIFICATION_CATEGORY`\n- **CONTAINS** / **CONTAINS_NOT** — use with `EXTERNAL_EXCEPTION_ID`, `NAME`, `REQUESTOR_NAME`, `APPROVER_NAME`, `JUSTIFICATION_TEXT`, `APPROVAL_JUSTIFICATION`, `REQUESTOR_EMAIL`, `APPROVER_EMAIL`" }, "SEARCH_VALUE": { "description": "Value that this filter must match. The contents of this field will differ depending on the field that you specified for this filter:\n\n- EXCEPTION_ID — Integer, e.g. `1`, `42`\n- EXTERNAL_EXCEPTION_ID — String, e.g. `\"EXT-001\"`\n- NAME — String, e.g. `\"CVE Exception\"`\n- STATUS — String. Values are: `APPROVED`, `DISABLED`, `EXPIRED`, `NO_DECISION_MADE`, `PENDING_DECISION`, `REJECTED`, `SELF_APPROVED`\n- EXPIRATION_TS — Epoch milliseconds, e.g. `1712448000000`\n- IMPACTED_ISSUES_COUNT — Integer, e.g. `0`, `10`, `100`\n- BACKWARD_SCAN_STATUS — String. Values are: `COMPLETED`, `FAILED`, `IN_PROGRESS`, `PENDING`\n- JUSTIFICATION_CATEGORY — String. Values are: `COMPENSATING_CONTROL`, `PLANNED_REMEDIATION`, `RISK_ACCEPTED`, `VENDOR_DEPENDENCY`\n- REQUESTOR_NAME — String, e.g. `\"John Doe\"`\n- APPROVER_NAME — String, e.g. `\"Jane Smith\"`\n- CREATED_TS — Epoch milliseconds, e.g. `1712448000000`\n- APPROVAL_TS — Epoch milliseconds, e.g. `1712448000000`\n- JUSTIFICATION_TEXT — String, e.g. `\"Risk accepted per policy\"`\n- APPROVAL_JUSTIFICATION — String, e.g. `\"Approved by security team\"`\n- REQUESTOR_EMAIL — String, e.g. `\"john@example.com\"`\n- APPROVER_EMAIL — String, e.g. `\"jane@example.com\"`", "oneOf": [ { "type": "string" }, { "type": "integer" }, { "type": "array", "items": { "type": "string" } } ] } } }, "search_from": { "type": "integer", "default": 0, "description": "Starting index for pagination." }, "search_to": { "type": "integer", "default": 100, "description": "Ending index for pagination." }, "sort": { "type": "object", "nullable": true, "description": "Sort configuration", "properties": { "FIELD": { "type": "string", "description": "Field name to sort by" }, "ORDER": { "type": "string", "enum": [ "ASC", "DESC" ], "description": "Sort direction" } } } } } } }, "examples": { "default_search": { "summary": "Default search (all exceptions, first 100)", "value": { "request_data": {} } }, "filtered_search": { "summary": "Search with filters and pagination", "value": { "request_data": { "filters": { "AND": [ { "SEARCH_FIELD": "STATUS", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "APPROVED" } ] }, "search_from": 0, "search_to": 50, "sort": { "FIELD": "EXCEPTION_ID", "ORDER": "DESC" } } } }, "search_by_name": { "summary": "Search by exception name", "value": { "request_data": { "filters": { "AND": [ { "SEARCH_FIELD": "NAME", "SEARCH_TYPE": "CONTAINS", "SEARCH_VALUE": "CVE-2024" } ] }, "search_from": 0, "search_to": 25 } } } } } } }, "responses": { "200": { "description": "Exceptions retrieved successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "exceptions": { "type": "array", "description": "List of matching exception objects", "items": { "$ref": "#/components/schemas/IssueException" } }, "filter_count": { "type": "integer", "description": "Number of exceptions matching the applied filters" }, "total_count": { "type": "integer", "description": "Total number of exceptions (ignoring filters)" } } } } }, "examples": { "default": { "value": { "reply": { "exceptions": [ { "exception_id": 1, "external_exception_id": null, "name": "CVE-2024-1234 Exception", "status": "APPROVED", "rule": "{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"cve_id\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":\"CVE-2024-1234\"}]}}", "pretty_rule": "[\"cve_id = CVE-2024-1234\"]", "justification_text": "Risk accepted for legacy hosts", "justification_category": "RISK_ACCEPTED", "approval_justification": null, "requestor_name": "John Doe", "requestor_email": "john.doe@example.com", "approver_email": "security-lead@example.com", "approver_name": "Jane Smith", "created_ts": "2025-01-15T10:30:00Z", "modified_ts": "2025-01-15T10:30:00Z", "approval_ts": "2025-01-15T11:00:00Z", "expiration_ts": "2025-06-30T23:59:59Z", "impacted_issues_count": 150, "backward_scan_status": "COMPLETED", "backward_scan_ts": "2025-01-15T11:05:00Z", "reversion_scan_status": null, "reversion_scan_ts": null } ], "filter_count": 1, "total_count": 10 } } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } }, "tags": [ "Issues" ] } } }, "components": { "schemas": { "Issue": { "type": "object", "description": "Issue object returned by the search endpoint. Fields correspond to the PUBLIC_FIELDS_GET_ISSUE list in the codebase.", "properties": { "_insert_time": { "type": "integer", "format": "int64", "description": "Issue creation timestamp in epoch milliseconds.", "nullable": true, "example": 1705312200000 }, "external_id": { "type": "string", "example": "EXT-12345" }, "name": { "type": "string", "example": "Suspicious Network Activity" }, "description": { "type": "string", "example": "Unusual outbound traffic detected from internal server" }, "observation_time": { "type": "integer", "format": "int64", "example": 1621234567890 }, "domain": { "type": "string", "description": "Issue domain. Default domains listed below; custom domains may also be configured per tenant.", "enum": [ "Security", "Health", "Hunting", "IT", "Posture" ], "example": "Security" }, "detection.method": { "type": "string", "description": "Detection source or method that created the issue.", "enum": [ "TRAPS", "MAGNIFIER", "ANALYTICS_BIOC", "FW", "BIOC", "IOC", "THREAT_INTELLIGENCE", "MTH", "CORRELATION", "PRISMA_CLOUD", "PRISMA_CLOUD_COMPUTE", "XPANSE", "IOT", "CREATE_ALERT_PUBLIC_API", "HEALTH", "EMAIL_ATTACHMENT", "ATTACK_PATH", "POSTURE_POLICY", "CAS_DRIFT_SCANNER", "CLOUD_NETWORK_ANALYZER", "CAS_IAC_SCANNER", "CAS_SECRET_SCANNER", "CAS_CI_CD_RISK_SCANNER", "CLI_SCANNER", "CIEM_SCANNER", "API_TRAFFIC_MONITOR", "API_POSTURE_SCANNER", "AGENTLESS_DISK_SCANNER", "KUBERNETES_SCANNER", "COMPUTE_POLICY", "CSPM_SCANNER", "CAS_CVE_SCANNER", "CAS_LICENSE_SCANNER", "SECRETS_SCANNER", "CAS_SAST_SCANNER", "DATA_POLICY", "CAS_OPERATIONAL_RISK_SCANNER", "VULNERABILITY_POLICY", "AISPM_RULE_ENGINE", "DLP", "MIRRORING", "AURL", "USER_REPORTED_PHISHING", "GRAPH_ENGINE" ], "example": "BIOC" }, "detection.rule_id": { "type": "string", "example": "RULE-9876" }, "category": { "type": "string", "description": "Issue category classification.", "enum": [ "CONFIGURATION", "VULNERABILITY", "MALWARE", "IDENTITY", "NETWORK", "DATA_LOSS", "COMPLIANCE", "RUNTIME", "SECRETS", "IAC", "CI_CD_RISKS", "DRIFT", "API_SECURITY", "POSTURE", "COMPUTE", "LICENSE", "OPERATIONAL_RISK", "AI_SECURITY" ], "example": "CONFIGURATION" }, "findings": { "type": "array", "items": { "type": "string" }, "example": [ "013543ea00ea9893bcde59cbfdc5992f" ] }, "asset_ids": { "type": "array", "items": { "type": "string", "example": "a8d24e796ef264a33e6e84c707ff2f67" } }, "asset_names": { "type": "array", "items": { "type": "string" }, "example": [ "pc-national-bank-sales-data-532ctl" ] }, "asset_group_ids": { "type": "array", "items": { "type": "integer" }, "example": [ 5, 7, 11, 42, 45, 131 ] }, "asset_classes": { "type": "array", "items": { "type": "string", "enum": [ "Compute", "Data", "Network", "Identity", "Security", "Management", "Application", "IoT", "Other" ] }, "example": [ "Data", "Compute" ] }, "asset_categories": { "type": "array", "items": { "type": "string", "enum": [ "Storage Bucket", "Virtual Machine", "Database Instance", "Container", "Serverless Function", "Load Balancer", "Firewall", "VPN Gateway", "IAM Role", "IAM User", "IAM Group", "IAM Policy", "Service Account", "Kubernetes Cluster", "Kubernetes Pod", "Kubernetes Node", "Network Interface", "Subnet", "VPC", "Security Group", "DNS Zone", "Certificate", "Key Vault", "Disk", "Snapshot", "Image", "Queue", "Topic", "API Gateway", "CDN", "Other" ] }, "example": [ "Storage Bucket", "Virtual Machine", "Database Instance" ] }, "asset_regions": { "type": "array", "items": { "type": "string" }, "description": "Cloud regions where the assets are located. Values depend on the cloud provider (e.g., AWS: us-east-1, Azure: eastus, GCP: us-central1).", "example": [ "us-east-1", "us-west-2", "eu-central-1" ] }, "asset_providers": { "type": "array", "items": { "type": "string", "enum": [ "AWS", "Azure", "GCP", "Oracle Cloud", "IBM Cloud", "Alibaba Cloud", "Other" ] }, "example": [ "AWS", "Azure", "GCP", "Oracle Cloud", "IBM Cloud" ] }, "asset_accounts": { "type": "array", "items": { "type": "string" }, "example": [ "883588134481" ] }, "asset_types": { "type": "array", "items": { "type": "string" }, "example": [ "Virtual Machine", "Storage Bucket" ] }, "mitre_tactics": { "type": "array", "items": { "type": "string" }, "example": [ "TA0004 - Privilege Escalation" ] }, "mitre_techniques": { "type": "array", "items": { "type": "string" }, "example": [ "T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching" ] }, "type": { "type": "string", "example": "Identity Security" }, "remediation": { "type": "string", "example": "Isolate affected system and investigate traffic patterns" }, "extended_description": { "type": "string", "example": "Detailed analysis of the network traffic patterns and potential impact" }, "impact": { "type": "string", "example": "Potential data exfiltration or command and control activity" }, "id": { "type": "integer", "description": "Internal numeric ID of the issue.", "example": 123 }, "last_update_timestamp": { "type": "integer", "format": "int64", "example": 1621235678901 }, "tags": { "type": "array", "items": { "type": "string" }, "example": [ "critical", "investigation_required" ] }, "is_excluded": { "type": "boolean", "example": false }, "is_starred": { "type": "boolean", "example": true }, "assigned_to": { "type": "string", "example": "alice.smith@example.com" }, "assigned_to_pretty": { "type": "string", "example": "Alice Smith" }, "status.progress": { "type": "string", "description": "Current status of the issue. Built-in values are 'New', 'In Progress', and 'Resolved'. Additional custom statuses may be configured per tenant.", "enum": [ "New", "In Progress", "Resolved" ], "example": "Resolved" }, "status.resolution_reason": { "type": "string", "description": "Resolution reason for resolved issues. Null when issue is not resolved. Built-in values are listed below. Additional values may be available depending on tenant configuration.", "enum": [ "RESOLVED_THREAT_HANDLED", "RESOLVED_KNOWN_ISSUE", "RESOLVED_DUPLICATE", "RESOLVED_FALSE_POSITIVE", "RESOLVED_OTHER", "RESOLVED_TRUE_POSITIVE", "RESOLVED_SECURITY_TESTING", "RESOLVED_RISK_ACCEPTED", "RESOLVED_FIXED", "RESOLVED_DISMISSED", "RESOLVED_AUTO_RESOLVE" ], "nullable": true, "example": "RESOLVED_OTHER" }, "status.resolution_comment": { "type": "string", "description": "Free-text comment provided when resolving the issue. Null when the issue is not resolved or no comment was provided.", "example": "Investigating the source of suspicious traffic" }, "severity": { "type": "string", "enum": [ "INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL" ], "example": "HIGH" }, "resolution_status_modified_ts": { "type": "integer", "format": "int64", "description": "Epoch timestamp in milliseconds when the resolution status was last modified.", "example": 1621240000000 }, "case_ids": { "type": "array", "items": { "type": "integer" }, "description": "List of case IDs this issue is associated with.", "example": [ 3, 42 ] }, "initial_evidence": { "type": "string", "description": "Initial evidence that triggered the issue.", "example": "Security group sg-12345 allows inbound TCP/5432 from 0.0.0.0/0" }, "is_excepted": { "type": "boolean", "description": "Indicates if the issue has an active exception.", "example": false }, "exception_ids": { "type": "array", "items": { "type": "string" }, "description": "List of exception IDs applied to this issue.", "nullable": true }, "exception_expiration": { "type": "integer", "format": "int64", "description": "Epoch timestamp in milliseconds when the exception expires.", "nullable": true }, "agentic_response_status": { "type": "string", "description": "Status of the agentic response for this issue.", "nullable": true }, "agentic_assistant_id": { "type": "string", "description": "ID of the agentic assistant handling this issue.", "nullable": true }, "agentic_response_conversation_id": { "type": "string", "description": "Conversation ID for the agentic response.", "nullable": true }, "action_status": { "type": "string", "description": "Current action status of the issue.", "example": "SCANNED" }, "asset_external_provider_ids": { "type": "array", "items": { "type": "string" }, "description": "List of external provider IDs for assets associated with the issue." }, "asset_cloud_account_names": { "type": "array", "items": { "type": "string" }, "description": "List of cloud account names for assets associated with the issue." }, "normalized_fields": { "$ref": "#/components/schemas/NormalizedFields" }, "custom_fields": { "type": "object" } } }, "NormalizedFields": { "type": "object", "properties": { "xdm.source.location.country": { "type": "array", "items": { "type": "string" }, "example": [ "US" ] }, "xdm.source.ipv4": { "type": "array", "items": { "type": "string" }, "example": [ "192.168.1.1" ] }, "xdm.source.host.ipv4_addresses": { "type": "array", "items": { "type": "string" }, "example": [ "192.168.1.2", "192.168.1.3" ] }, "xdm.source.identity.username": { "type": "array", "items": { "type": "string" }, "example": [ "admin" ] }, "xdm.source.process.causality_id": { "type": "array", "items": { "type": "string" }, "example": [ "abc123" ] }, "xdm.source.process.command_line": { "type": "array", "items": { "type": "string" }, "example": [ "/usr/bin/process -arg1 -arg2" ] }, "xdm.source.process.executable.filename": { "type": "string", "example": "process_executable" }, "xdm.source.process.name": { "type": "array", "items": { "type": "string" }, "example": [ "process_name" ] }, "xdm.source.process.executable.path": { "type": "array", "items": { "type": "string" }, "example": [ "/usr/bin/process_executable" ] }, "xdm.source.process.executable.sha256": { "type": "array", "items": { "type": "string" }, "example": [ "f9c7b6e24f7e93d8d3e5c76f8b1b88cd8f17b34a7a4a2e3d5b2dbf09f5b8fdc2" ] }, "xdm.source.host.hostname": { "type": "string", "example": "hostname1" }, "xdm.source.host.os_family": { "type": "string", "example": "Linux" }, "xdm.source.agent.identifier": { "type": "string", "example": "agent123" }, "xdm.source.agent.installation_id": { "type": "string", "example": "installation123" }, "xdm.source.host.fqdn": { "type": "string", "example": "hostname1.domain.com" }, "xdm.source.process.executable.signature_status": { "type": "array", "items": { "type": "string" }, "example": [ "SIGNATURE_UNAVAILABLE" ] }, "xdm.target.file.filename": { "type": "array", "items": { "type": "string" }, "example": [ "target_file.txt" ] }, "xdm.target.module.filename": { "type": "string", "example": "target_module.so" }, "xdm.target.file.sha256": { "type": "array", "items": { "type": "string" }, "example": [ "d4bfc6fabe8d6d1b76e5b441dc8d01758276281f56c929b282ac5c3ee704c431" ] }, "xdm.target.module.sha256": { "type": "string", "example": "7f4eafdad74bfedabf370a3725a5077c" }, "xdm.target.process.command_line": { "type": "array", "items": { "type": "string" }, "example": [ "/usr/bin/target_process -option" ] }, "xdm.target.process.executable.sha256": { "type": "array", "items": { "type": "string" }, "example": [ "7b21d50d6270f95b5a2cf582bf94b315cd75a034dd9478c0e5b4089bbd9b59ac" ] }, "xdm.target.process.executable.signature_status": { "type": "array", "items": { "type": "string" }, "example": [ "SIGNATURE_UNAVAILABLE" ] }, "xdm.target.process.executable.signer": { "type": "array", "items": { "type": "string" } }, "xdm.target.process.executable.path": { "type": "array", "items": { "type": "string" } }, "xdm.target.ipv4": { "type": "array", "items": { "type": "string" } }, "xdm.target.host.ipv4_addresses": { "type": "array", "items": { "type": "string" }, "example": [ "10.0.0.2", "10.0.0.3" ] }, "xdm.target.host.ipv6_addresses": { "type": "array", "items": { "type": "string" } }, "xdm.target.ipv6": { "type": "array", "items": { "type": "string" }, "example": [ "10.0.0.2", "10.0.0.3" ] }, "xdm.target.port": { "type": "array", "items": { "type": "integer" }, "example": [ 8080 ] }, "xdm.target.location.country": { "type": "string", "example": "US" }, "xdm.target.host.hostname": { "type": "string", "example": "hostname" }, "xdm.target.identity.username": { "type": "string", "example": "user1" }, "xdm.target.url": { "type": "string", "example": "https://example.com" }, "xdm.target.process.executable.filename": { "type": "array", "items": { "type": "string" }, "example": [ "target_process" ] }, "xdm.target.process.name": { "type": "string", "example": "target_process" }, "xdm.target.agent.identifier": { "type": "string", "example": "target_agent" }, "xdm.target.registry.value": { "type": "array", "items": { "type": "string" }, "example": [ "registry_value" ] }, "xdm.target.registry.data": { "type": "array", "items": { "type": "string" }, "example": [ "registry_data" ] }, "xdm.target.registry.key": { "type": "array", "items": { "type": "string" }, "example": [ "registry_key" ] }, "xdm.email.attachment.sha256": { "type": "string", "example": "a1b2c3d4e5f6789abcde1234567890f2" }, "xdm.email.attachment.filename": { "type": "string", "example": "attachment.pdf" }, "xdm.email.sender": { "type": "string", "example": "sender@example.com" }, "xdm.event.type": { "type": "string", "example": "Intrusion" }, "xdm.cloud.provider": { "type": "string", "example": "AWS" }, "xdm.cloud.project": { "type": "string", "example": "CloudProject1" }, "xdm.cloud.project_id": { "type": "string", "example": "cloud_project_id_123" }, "xdm.cloud.region": { "type": "string", "example": "us-east-1" }, "xdm.cloud.function.id": { "type": "string", "example": "cloud_func_123" }, "xdm.cloud.function.name": { "type": "string", "example": "cloud_function" }, "xdm.cloud.function.version": { "type": "string", "example": "v1.0.0" }, "xdm.cloud.function.request_id": { "type": "string", "example": "req_123" }, "xdm.cloud.function.runtime": { "type": "string", "example": "nodejs" }, "xdm.observer.unique_identifier": { "type": "string", "example": "observer123" }, "xdm.observer.type": { "type": "string", "example": "Server" }, "xdm.observer.sub_type": { "type": "string", "example": "Linux" }, "xdm.observer.name": { "type": "string", "example": "Observer 1" }, "xdm.vulnerability.cve_id": { "type": "string", "example": "CVE-2021-12345" }, "xdm.vulnerability.severity": { "type": "string", "enum": [ "INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL" ], "example": "HIGH" }, "xdm.vulnerability.fix_versions": { "type": "array", "items": { "type": "string" }, "example": [ "1.0.1", "1.0.2" ] }, "xdm.vulnerability.cve_risk_factors": { "type": "array", "items": { "type": "string" }, "example": [ "Exploitability", "Impact" ] }, "xdm.vulnerability.cvss_score": { "type": "number", "format": "float", "example": 7.8 }, "xdm.vulnerability.cvss_vector": { "type": "string", "example": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "xdm.software_package.version": { "type": "string", "example": "1.0.0" }, "xdm.software_package.purl": { "type": "string", "example": "pkg:maven/com.example/software@1.0.0" }, "xdm.software_package.layer_id": { "type": "string", "example": "layer123" }, "xdm.software_package.type": { "type": "string", "example": "Library" }, "xdm.software_package.installation_type": { "type": "string", "example": "Automatic" }, "xdm.software_package.package_manager": { "type": "string", "example": "npm" }, "xdm.software_package.dependency_type": { "type": "string", "example": "Direct" }, "xdm.software_package.language": { "type": "string", "example": "JavaScript" }, "xdm.malware.verdict": { "type": "string", "example": "Malicious" }, "xdm.malware.virus_total_link": { "type": "string", "example": "https://www.virustotal.com/gui/file/abcd1234" }, "xdm.malware.layer_id": { "type": "string", "example": "malware_layer123" }, "xdm.secret.secret_type": { "type": "string", "example": "API Key" }, "xdm.secret.unique_identifier": { "type": "string", "example": "secret_id_123" }, "xdm.secret.snippet": { "type": "string", "example": "API Key: 12345" }, "xdm.secret.layer_id": { "type": "string", "example": "secret_layer123" }, "xdm.file.filename": { "type": "string", "example": "file.txt" }, "xdm.file.path": { "type": "array", "items": { "type": "string" }, "example": [ "/path/to/file.txt" ] }, "xdm.file.sha256": { "type": "string", "example": "abc1234567890def0987654321" }, "xdm.file.size": { "type": "integer", "example": 1024 }, "xdm.file.last_modified": { "type": "integer", "example": 1615465123 }, "xdm.file.metadata_change_time": { "type": "integer", "example": 1615465000 }, "xdm.file.owner_id": { "type": "string", "example": "user1" }, "xdm.file.owner_name": { "type": "string", "example": "fileowner" }, "xdm.file.group_id": { "type": "string", "example": "group1" }, "xdm.file.group_name": { "type": "string", "example": "groupname" }, "xdm.file.permissions.owner": { "type": "array", "items": { "type": "string" }, "example": [ "read", "write" ] }, "xdm.file.permissions.group": { "type": "array", "items": { "type": "string" }, "example": [ "read" ] }, "xdm.file.permissions.others": { "type": "array", "items": { "type": "string" }, "example": [ "read" ] }, "xdm.file.position.start.line": { "type": "integer", "example": 1 }, "xdm.file.position.start.character": { "type": "integer", "example": 0 }, "xdm.file.position.end.line": { "type": "integer", "example": 100 }, "xdm.file.position.end.character": { "type": "integer", "example": 80 }, "xdm.url": { "type": "string", "example": "https://example.com" }, "xdm.domain": { "type": "string", "example": "example.com" }, "xdm.application_protocol": { "type": "string", "example": "HTTPS" } } }, "IssueException": { "type": "object", "description": "Full issue exception object as returned by the public API", "properties": { "exception_id": { "type": "integer", "nullable": true, "description": "Auto-incremented exception ID" }, "external_exception_id": { "type": "string", "nullable": true, "description": "External tracking ID" }, "name": { "type": "string", "description": "Exception name" }, "status": { "type": "string", "enum": [ "APPROVED", "DISABLED", "EXPIRED", "NO_DECISION_MADE", "PENDING_DECISION", "REJECTED", "SELF_APPROVED" ], "description": "Exception status" }, "rule": { "type": "string", "description": "JSON-encoded filter rule" }, "pretty_rule": { "type": "string", "nullable": true, "description": "Human-readable representation of the rule" }, "justification_text": { "type": "string", "description": "Justification text" }, "justification_category": { "type": "string", "enum": [ "COMPENSATING_CONTROL", "PLANNED_REMEDIATION", "RISK_ACCEPTED", "VENDOR_DEPENDENCY" ], "nullable": true, "description": "Justification category" }, "approval_justification": { "type": "string", "nullable": true, "description": "Approval decision justification" }, "requestor_name": { "type": "string", "description": "Name of the user who requested the exception" }, "requestor_email": { "type": "string", "description": "Email of the user who requested the exception" }, "approver_email": { "type": "string", "nullable": true, "description": "Email of the assigned approver" }, "approver_name": { "type": "string", "nullable": true, "description": "Name of the assigned approver" }, "created_ts": { "type": "string", "format": "date-time", "nullable": true, "description": "Creation timestamp" }, "modified_ts": { "type": "string", "format": "date-time", "nullable": true, "description": "Last modification timestamp" }, "approval_ts": { "type": "string", "format": "date-time", "nullable": true, "description": "Approval decision timestamp" }, "expiration_ts": { "type": "string", "format": "date-time", "description": "Exception expiration timestamp" }, "impacted_issues_count": { "type": "integer", "description": "Number of issues impacted by this exception" }, "backward_scan_status": { "type": "string", "enum": [ "COMPLETED", "FAILED", "IN_PROGRESS", "PENDING" ], "nullable": true, "description": "Status of backward scan" }, "backward_scan_ts": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp of the last backward scan" }, "reversion_scan_status": { "type": "string", "enum": [ "COMPLETED", "FAILED", "IN_PROGRESS", "PENDING" ], "nullable": true, "description": "Reversion scan status" }, "reversion_scan_ts": { "type": "string", "format": "date-time", "nullable": true, "description": "Timestamp of the last reversion scan" } } }, "CreateIssueException": { "type": "object", "description": "Request data for creating a new issue exception.", "required": [ "name", "rule", "justification_text", "justification_category", "approver_email", "expiration_ts" ], "properties": { "name": { "type": "string", "description": "Human-readable name for the exception" }, "external_exception_id": { "type": "string", "nullable": true, "description": "Optional external tracking ID for the exception" }, "rule": { "type": "string", "description": "JSON-encoded filter rule defining which issues this exception applies to. Uses the standard Cortex filter format with `AND`/`OR` structure. The value of each `SEARCH_FIELD` must be one of the supported field names — see [Issue exception supported fields](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/issues-apis/issues-papi-tables#supported-fields-for-issue-exception-filters) for the complete list." }, "justification_text": { "type": "string", "description": "Free-text justification explaining why this exception is needed" }, "justification_category": { "type": "string", "enum": [ "COMPENSATING_CONTROL", "PLANNED_REMEDIATION", "RISK_ACCEPTED", "VENDOR_DEPENDENCY" ], "description": "Category of justification for the exception" }, "approval_justification": { "type": "string", "description": "Free-text justification explaining why this exception is approved or rejected" }, "approver_email": { "type": "string", "description": "Email of the designated approver. Required when the tenant has approval workflow enabled. Must match a registered approver." }, "expiration_ts": { "type": "string", "format": "date-time", "description": "Expiration date/time for the exception. Accepts ISO 8601 date-time or date-only format. Date-only values are normalized to end-of-day UTC (23:59:59)." } } }, "CreateIssue": { "type": "object", "properties": { "owner": { "type": "string", "example": "CWP" }, "name": { "type": "string", "example": "Unauthorized Access Detected" }, "description": { "type": "string", "example": "An unauthorized login attempt was detected from an unknown IP address." }, "observation_time": { "type": "integer", "format": "int64", "example": 1700000000000 }, "issue_domain": { "type": "string", "description": "Issue domain. Note: The create request uses `issue_domain` as the field name, while the search response returns this value as `domain`.", "example": "Security" }, "category": { "type": "string", "example": "CONFIGURATION" }, "asset_ids": { "type": "array", "items": { "type": "string" }, "example": [ "asset-456" ] }, "mitre_tactics": { "type": "array", "items": { "type": "string" }, "example": [ "TA0001", "TA0002" ] }, "mitre_techniques": { "type": "array", "items": { "type": "string" }, "example": [ "T1003", "T1059" ] }, "type": { "type": "string", "example": "Threat Intelligence" }, "remediation": { "type": "string", "example": "Apply security patches and restrict access to affected resources." }, "extended_description": { "type": "string", "example": "This alert was triggered due to multiple failed login attempts within a short time frame." }, "impact": { "type": "string", "example": "Potential unauthorized system access" }, "initial_evidence": { "type": "string", "example": "The fine-tuned model llama3, hosted in AWS under the account my_account, was trained on /secrets, which was found to be publicly writable in S3 my_bucket" }, "tags": { "type": "array", "items": { "type": "string" }, "example": [ "critical", "network" ] }, "is_excluded": { "type": "boolean", "example": false }, "is_starred": { "type": "boolean", "example": true }, "assigned_to": { "type": "string", "example": "security_team_lead" }, "assigned_to_pretty": { "type": "string", "example": "Alice Smith" }, "severity": { "type": "string", "enum": [ "INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL" ], "example": "HIGH" }, "normalized_fields": { "$ref": "#/components/schemas/NormalizedFields" }, "custom_fields": { "type": "object" } }, "required": [ "name", "description", "observation_time", "issue_domain", "category", "severity" ] }, "IssueSchemaField": { "type": "object", "properties": { "field_name": { "type": "string", "example": "xdm.issue.name" }, "field_pretty_name": { "type": "string", "example": "Name" }, "data_type": { "type": "string", "example": "TEXT" } } }, "UpdateIssue": { "type": "object", "description": "At least one of `severity` or `status` must be provided. When setting `status` to `Resolved`, the `status_resolution_reason` field is required.", "properties": { "severity": { "type": "string", "enum": [ "INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL" ], "example": "HIGH" }, "status": { "type": "string", "enum": [ "New", "In Progress", "Resolved" ], "example": "Resolved" }, "status_resolution_reason": { "type": "string", "description": "Resolution reason when status is set to 'Resolved'. Required when resolving an issue. Built-in values are listed below. Additional values such as 'Resolved - Risk Accepted', 'Resolved - Fixed', and 'Resolved - Dismissed' may be available depending on tenant licensing. Values are case-insensitive.", "enum": [ "Resolved - Threat Handled", "Resolved - Known Issue", "Resolved - Duplicate Issue", "Resolved - False Positive", "Resolved - Other", "Resolved - True Positive", "Resolved - Security Testing", "Resolved - Risk Accepted", "Resolved - Fixed", "Resolved - Dismissed" ], "example": "Resolved - Other" }, "status_resolution_comment": { "type": "string", "example": "Issue has been marked as a false positive." } } } }, "responses": { "Unauthorized": { "description": "Unauthorized access", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Unauthorized request" } } } } } }, "InternalError": { "description": "Internal server error", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Internal server error" } } } } } }, "BadRequest": { "description": "Bad request", "content": { "application/json": { "schema": { "type": "object", "properties": { "error": { "type": "string", "example": "Invalid request data" } } } } } } } } }