REST API call to retrieve incident IDs

You can use this REST API call to return a list of incident IDs starting from the specified parameter.

GET request URL

https://<epo_server_name:port>/rest/dlp/incidents/ids?startTime={epochmillis}&incidentNature={n}

Where

epo_server_name:port is the server IP address and port number.
startTime={epochmillis} is the time specified in terms of epoch milliseconds. It is the starting time of the incident occurred from where the list of incident IDs must be retrieved.
incidentNature={n} based on the value of n specified, incidents generated for different data vectors are retrieved.

Request Parameters

Parameter name	Description	Required	Values
Authorization	User credentials for ePO - On-prem.	Required
startTime= {epochmillis}	Starting time of incident occurred from where the list of incident IDs must be fetched.	Required	Number
incidentNature={n}	Retrieve incidents for different data vectors. Where {n} can be: 1 = Retrieve incidents generated for data-in-use/motion 2 = Reserved to retrieve data-at-rest - Endpoint Discovery incidents and can be used when support for Endpoint Discovery custom attributes is added into the product 3 = Retrieve incidents generated for data-at-rest - Network	Required	Number

Parameter name

Description

Required

Values

Authorization

User credentials for ePO - On-prem.

Required

startTime= {epochmillis}

Starting time of incident occurred from where the list of incident IDs must be fetched.

Required

Number

incidentNature={n}

Retrieve incidents for different data vectors.

Where {n} can be:

1 = Retrieve incidents generated for data-in-use/motion
2 = Reserved to retrieve data-at-rest - Endpoint Discovery incidents and can be used when support for Endpoint Discovery custom attributes is added into the product
3 = Retrieve incidents generated for data-at-rest - Network

Required

Number

Sample GET request URL

https://172.27.108.53:8443/rest/dlp/incidents/ids?startTime=1625204620000&incidentNature=1

Sample cURL command

curl -k -v -X GET 'https://ePO-url:ePO-port/rest/dlp/incidents/ids?startTime=1625204620000&incidentNature=1' -u '<user>:<password>'

Response parameters

These parameters are returned for the API request. The response to this API call returns a list of incident IDs based on the set starting time and can return a maximum of up to 1000 incident IDs.

Element		Description	Data type
incidentIds		IDs assigned to incidents in DLP Incident Manager.	string
endTime		endTime corresponds to the last incident occurred time in the incident ID list. If the value is "null", there are no more incidents to be fetched. When there are more than 1000 incidents, the value of end time is an epoch value. You can use this value as the start time to fetch the next batch of incident IDs until the endTime is returned as "null".	string

Sample response

{
    "incidentIds": [
        "18",
        "17",
        "14",
        "15",
        "16",
        "11",
        "12",
        "13",
        "8",
        "9",
        "10",
        "5",
        "6",
        "7",
        "3",
        "4",
        "1",
        "2"
    ],
    "endTime": "null"
}

Status and error codes

List of HTTP status codes returned for the query.

Code	Description
200 OK	The response returns a list of incident IDs and an end time which corresponds to the maximum incident occurred time in the incident ID list. If the value of end time is "null", there are no more incidents to be fetched. When the value of end time is an epoch, use this as the start time to fetch the next batch of incident IDs.
400 Bad Request	If startTime is missing or has a non-numeric epoch value If incidentNature is missing or has a non-numeric value
404 Not Found	Incorrect ePO - On-prem URL.
500 Internal Server Error	An error on the server side that failed the request. See the ePO - On-prem `orion.log` file for more details about the error.