Incident Report - Cisco XDR APIs

{"type":"api","title":"Incident Report","meta":{"id":"/apps/pubhub/media/cisco-xdr-api-docs/fa9197522b1e6452b6dbfc472555dcc7ceeb71bd/f4d118ae-a2d7-3c4b-98c4-c1e55e1f5e68","info":{"title":"Conure v2","description":"Cisco XDR Incidents and Investigation API","contact":{"name":"Cisco Security Business Group -- Advanced Threat","email":"cisco-intel-api-support@cisco.com"},"license":{"name":"All Rights Reserved","url":"https://www.cisco.com"},"version":"51-1-6bee0d16"},"security":[{"oAuth2":["integration:read","private-intel:read","profile:read","inspect:read","users:read","invite:read","enrich:read","oauth:read","response:read","global-intel:read","ao:read"]}],"x-parser-conf":{"serverConfig":"select","overview":{"markdownPath":"reference/conure/overview.md","uri":"incidents-and-investigations-api-guide"},"disableAuthEditing":true,"exampleAsDefault":true,"oAuth2":{"clientId":"client-546e34fc-c6bf-4951-ac69-f6d7987a7814","clientSecret":"MYw4_E_tBdFwUwrX6WFYKVD5LQrG2k7XrJ5J046wWE0s1gAKCxJ8VA","proxyEnabled":false},"meta":{"useProxy":true}},"openapi":"3.0.1","servers":[{"url":"https://conure.us.security.cisco.com/{basePath}","variables":{"basePath":{"default":""}}}],"securitySchemes":{"oAuth2":{"type":"oauth2","flows":{"clientCredentials":{"tokenUrl":"https://visibility.amp.cisco.com/iroh/oauth2/token","scopes":{"telemetry":"Collect application data for analytics","integration:read":"Manage your modules","private-intel:read":"Access Private Intelligence","admin":"Provide admin privileges","cognitive":"Cognitive Integration","profile:read":"Get your profile information","inspect:read":"Extract Observables and data from text","asset":"Access and modify your assets","event":"Read IROH Events","feedback":"Submit Customer Feedback","sse":"SSE Integration. Manage your Devices.","registry":"Manage registry entries","users:read":"Manage users of your organization","investigation":"Perform threat analysis investigation","invite:read":"Invite users into your organization","casebook":"Access and modify your casebooks","orbital":"Orbital Integration.","enrich:read":"Query your configured modules for threat intelligence","oauth:read":"Manage OAuth2 Clients","vault":"Grants access to Module Vaults","response:read":"List and execute response actions using configured modules","notification":"Receive notifications from integrations","vglobal-intel:read":"Access AMP Global Intelligence","webhook":"Manage your Webhooks","ao:read":"AO Integration."}}}}}},"spec":{"tags":["Incident","Incident Report"],"summary":"Incident Report","parameters":[{"name":"incident-id","description":"The short-id for an incident, e.g. incident-64322795-2xx5-49bd-8d0b-106680ae434a.","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"required":["events","executive","incident","timeline"],"type":"object","properties":{"timeline":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["timeline"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"executive":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["executive"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"events":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["events"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"incident":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["incident"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}}}}},"application/transit+msgpack":{"schema":{"required":["events","executive","incident","timeline"],"type":"object","properties":{"timeline":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["timeline"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"executive":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["executive"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"events":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["events"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"incident":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["incident"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}}}}},"application/transit+json":{"schema":{"required":["events","executive","incident","timeline"],"type":"object","properties":{"timeline":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["timeline"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"executive":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["executive"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"events":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["events"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"incident":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["incident"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}}}}},"application/edn":{"schema":{"required":["events","executive","incident","timeline"],"type":"object","properties":{"timeline":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["timeline"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"executive":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["executive"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"events":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["events"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}},"incident":{"required":["ai_generated","content","created_at","error","failed","generating","section_id","updated_at","user_id"],"type":"object","properties":{"ai_generated":{"type":"boolean"},"content":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"created_at":{"type":"string","format":"date-time"},"error":{"maxLength":2500,"minLength":0,"type":"string","nullable":true},"failed":{"type":"boolean"},"generating":{"type":"boolean"},"section_id":{"type":"string","enum":["incident"]},"user_id":{"type":"string"},"updated_at":{"type":"string","format":"date-time","nullable":true}}}}}}}},"400":{"description":"","content":{"application/json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"object"}}}},"application/transit+msgpack":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"object"}}}},"application/transit+json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"object"}}}},"application/edn":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"object"}}}}}},"401":{"description":"","content":{"application/json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Unauthorized"]}}}},"application/transit+msgpack":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Unauthorized"]}}}},"application/transit+json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Unauthorized"]}}}},"application/edn":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Unauthorized"]}}}}}},"403":{"description":"","content":{"application/json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Forbidden"]}}}},"application/transit+msgpack":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Forbidden"]}}}},"application/transit+json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Forbidden"]}}}},"application/edn":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Forbidden"]}}}}}},"404":{"description":"","content":{"application/json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Not Found"]}}}},"application/transit+msgpack":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Not Found"]}}}},"application/transit+json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Not Found"]}}}},"application/edn":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Not Found"]}}}}}},"405":{"description":"","content":{"application/json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Method Not Allowed"]}}}},"application/transit+msgpack":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Method Not Allowed"]}}}},"application/transit+json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Method Not Allowed"]}}}},"application/edn":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Method Not Allowed"]}}}}}},"406":{"description":"","content":{"application/json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Not Acceptable"]}}}},"application/transit+msgpack":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Not Acceptable"]}}}},"application/transit+json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Not Acceptable"]}}}},"application/edn":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Not Acceptable"]}}}}}},"429":{"description":"","content":{"application/json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Too many requests"]}}}},"application/transit+msgpack":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Too many requests"]}}}},"application/transit+json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Too many requests"]}}}},"application/edn":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["Too many requests"]}}}}}},"500":{"description":"","content":{"application/json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["exception","default exception","sql exception","JSON too large","schema","external_request"]},"exception":{"type":"string","example":"SqlException"},"data":{"type":"object","description":"Any specific error information passed by custom errors.","example":""},"uri":{"type":"string","description":"The URI the error was seen at","example":"/global/v1/incident/?/incident-summary"}}}},"application/transit+msgpack":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["exception","default exception","sql exception","JSON too large","schema","external_request"]},"exception":{"type":"string","example":"SqlException"},"data":{"type":"object","description":"Any specific error information passed by custom errors.","example":""},"uri":{"type":"string","description":"The URI the error was seen at","example":"/global/v1/incident/?/incident-summary"}}}},"application/transit+json":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["exception","default exception","sql exception","JSON too large","schema","external_request"]},"exception":{"type":"string","example":"SqlException"},"data":{"type":"object","description":"Any specific error information passed by custom errors.","example":""},"uri":{"type":"string","description":"The URI the error was seen at","example":"/global/v1/incident/?/incident-summary"}}}},"application/edn":{"schema":{"required":["message"],"type":"object","properties":{"message":{"type":"string","enum":["exception","default exception","sql exception","JSON too large","schema","external_request"]},"exception":{"type":"string","example":"SqlException"},"data":{"type":"object","description":"Any specific error information passed by custom errors.","example":""},"uri":{"type":"string","description":"The URI the error was seen at","example":"/global/v1/incident/?/incident-summary"}}}}}}},"security":[{"JWT-Bearer":[]},{"oauth2":[]}],"method":"get","path":"/v2/incident/{incident-id}/report"}}