REST API call to get incident Ids for network discovery based on custom filter (Using S-Expression)

Use this REST API call to get a list of network discovery incidents based on the custom filters using S-Expression.

https://<epo_server_name:port>/rest/dlp/incidents/list/networkDiscovery/custom

Where, epo_server_name:port is the server IP address and port number.

Parameter name	Description	Required	Values
Authorization	User credentials for ePO - On-prem.	Optional
sexp	S-Expression taken from query xml generated from query and report section.	Optional	String

Create an S-Expression using these steps:

Log on to ePO - On-prem.
Go to Queries & Reports and click New Query.
Select the Database Type as DLP, and under Result Types, select DLP Data at Rest (Network) Incidents and click Next.
Select an appropriate value in the Chart section and click Next.
Select an appropriate option in the Columns section and click Next.
Add the required filter criteria in the Filter section and click Save.
Enter the Query Name and Query Description for your S-Expression and click Save.
Select your S-Expression and click Export Queries from Actions. The S-Expression Query.xml file gets downloaded.
Open the Query.xml file and copy S-Expression after sexp under <condition-uri> tag.
For example, <condition-uri>query:condition?orion.condition.sexp=%28+where+%28+gt+UDLP_EPD_Incidents.IncidentId+20++%29+%29</condition-uri>
The S-Expression is passed to the request body:
{
"sexp" : "%28+where+%28+gt+UDLP_EPD_Incidents.IncidentId+20++%29+%29"
}

Sample GET request URL

https://172.27.108.53:8443/rest/dlp/incidents/list/networkDiscovery/custom

{

"sexp":"%28+where+%28+gt+UDLP_DiscoveryIncident.IncidentId+40++%29+%29"

}

Sample cURL command

curl -k -v -X GET 'https://172.27.108.53:8443/rest/dlp/incidents/list/networkDiscovery/custom' -u '<user>:<password>'

--data-raw '{

"sexp":"%28+where+%28+gt+UDLP_DiscoveryIncident.IncidentId+40++%29+%29"

}'

These parameters are returned for the API request. The response to this API call returns a list of network discovery incident Ids.

Element		Description	Data type
Incident Id list		List of Incident IDs generated for data-in-use or data-in-motion is displayed. Also, shows the reason for failure, if there is a failure.	List of strings

{
    "sexp":"%28+where+%28+gt+UDLP_DiscoveryIncident.IncidentId+40++%29+%29"
}

Sample response

[
    "41",
    "42",
    "43",
    "44"
]

List of HTTP status codes returned for the query.

Code	Description
200 OK	Successfully received Item Ids and name satisfying conditions in request.
400 Bad Request	Returns a bad request if the payload is empty
404 Not Found	Incorrect ePO - On-prem URL.
500 Internal Server Error	An error on the server side that failed the request. See the ePO - On-prem `orion.log` file for more details about the error.