Fetch Incidents API

Use these API functions to get FIM incidents for an user account.

POST/fim/v3/incidents/search

Input ParametersInput Parameters

Parameter

Mandatory/Optional

Data Type

Description

filter 

 Optional String

Filter the incidents list by providing a query using Qualys syntax. Refer to the “How to Search” topic in the online help for assistance with creating your query.

For example - action: 'Content'

pageNumber 

 Optional String The page to be returned. Starts from zero.

pageSize

 Optional String The number of records per page to be included in the response. Default is 10.

sort 

 Optional String Sort the results using a Qualys token. For example - [{\"action\":\"asc\"}]

attributes 

 Optional String Search based on certain attributes (provide comma-separated list).
SearchAfter Mandatory String This parameter is required to fetch more than 10,000 rows.

SampleSample

API Request

curl -X POST '<qualys_base_url>/fim/v3/incidents/search 
--header 'Authorization: Bearer <authToken>'
--header 'content-type: application/json' 
--data-raw 
'{
          "filter":"status:CLOSED",
          "sort":"[\{\"dateTime\":\"desc\"}
]'

Response

[
  {
      "sortValues": [
                  1728882000000
        ],
      "data": {
                  "slaDurationKey": null,
                  "approvalDate": "2024-10-15T05:14:14.888+0000",
                  "approvalType": "MANUAL",
                  "markupStatus": "COMPLETED",
                  "type": "AUTOMATED",
                  "slaViolationDate": null,
                  "filterFromDate": "2024-10-14T05:00:00.000+0000",
                  "customerId": "25a14e60-80c1-4c25-8166-6653a4e2b094",
                  "ruleName": "test_4April",
                  "id": "486c1675-c752-4f5e-b34d-4b63774d252d",
                  "ruleId": "23db69b0-0876-48a2-bdf5-058913585bbb",
                  "approvalStatus": "APPROVED",
                  "marked": true,
                  "lastUpdatedBy": {
                  "date": 1728890505670,
                  "user": {
                    "name": "FIM Automation",
                    "id": "51fbdb4b-5fb5-fdf6-8141-5a7887ec557b"    
                }    
            },
                  "filterToDate": "2024-10-14T21:29:00.000+0000",
                  "assignDate": "2024-10-14T06:07:12.894+0000",
                  "changeType": "MANUAL",
                  "filters": 
           [
                  "dateTime: ['2024-10-14T05:00:00.000Z'..'
2024-10-14T21:29:00.000Z'] and (action:Create )"    
    
           ],
                  "reviewedBy": {
                  "date": 1728969254876,
                  "user": {
                    "name": "FIM Automation",
                    "id": "51fbdb4b-5fb5-fdf6-8141-5a7887ec557b" 
                }   
            },
                  "reviewers": [
                  "john_doe",
                  "johndoe",
                  "johnsmith@qualys.com"    
            ],
                  "slaDurationValue": 0,
                  "deleted": false,
                  "createdBy": {
                  "date": 1728886032875,
                  "user": {
                    "name": "FIM Automation",
                    "id": "51fbdb4b-5fb5-fdf6-8141-5a7887ec557b"   
                }    
            },
                  "slaRequired": false,
                  "name": "test_4April-20241014-060712",
                  "comment": "Events under this incident have been reviewed ",
                  "dispositionCategory": "PATCHING",
                "status": "CLOSED"      
        }   
    }
]