Use these API functions to get FIM incidents for an user account.
|
Parameter |
Mandatory/Optional |
Data Type |
Description |
|---|---|---|---|
|
filter |
Optional | String |
Filter the incidents list by providing a query using Qualys syntax. Refer to the “How to Search” topic in the online help for assistance with creating your query. For example - action: 'Content' |
|
pageNumber |
Optional | String | The page to be returned. Starts from zero. |
|
pageSize |
Optional | String | The number of records per page to be included in the response. Default is 10. |
|
sort |
Optional | String | Sort the results using a Qualys token. For example - [{\"action\":\"asc\"}] |
|
attributes |
Optional | String | Search based on certain attributes (provide comma-separated list). |
| SearchAfter | Mandatory | String | This parameter is required to fetch more than 10,000 rows. |
API Request
curl -X POST '<qualys_base_url>/fim/v3/incidents/search
--header 'Authorization: Bearer <authToken>'
--header 'content-type: application/json'
--data-raw
'{
"filter":"status:CLOSED",
"sort":"[\{\"dateTime\":\"desc\"}
]'
Response
[
{
"sortValues": [
1728882000000
],
"data": {
"slaDurationKey": null,
"approvalDate": "2024-10-15T05:14:14.888+0000",
"approvalType": "MANUAL",
"markupStatus": "COMPLETED",
"type": "AUTOMATED",
"slaViolationDate": null,
"filterFromDate": "2024-10-14T05:00:00.000+0000",
"customerId": "25a14e60-80c1-4c25-8166-6653a4e2b094",
"ruleName": "test_4April",
"id": "486c1675-c752-4f5e-b34d-4b63774d252d",
"ruleId": "23db69b0-0876-48a2-bdf5-058913585bbb",
"approvalStatus": "APPROVED",
"marked": true,
"lastUpdatedBy": {
"date": 1728890505670,
"user": {
"name": "FIM Automation",
"id": "51fbdb4b-5fb5-fdf6-8141-5a7887ec557b"
}
},
"filterToDate": "2024-10-14T21:29:00.000+0000",
"assignDate": "2024-10-14T06:07:12.894+0000",
"changeType": "MANUAL",
"filters":
[
"dateTime: ['2024-10-14T05:00:00.000Z'..'
2024-10-14T21:29:00.000Z'] and (action:Create )"
],
"reviewedBy": {
"date": 1728969254876,
"user": {
"name": "FIM Automation",
"id": "51fbdb4b-5fb5-fdf6-8141-5a7887ec557b"
}
},
"reviewers": [
"john_doe",
"johndoe",
"johnsmith@qualys.com"
],
"slaDurationValue": 0,
"deleted": false,
"createdBy": {
"date": 1728886032875,
"user": {
"name": "FIM Automation",
"id": "51fbdb4b-5fb5-fdf6-8141-5a7887ec557b"
}
},
"slaRequired": false,
"name": "test_4April-20241014-060712",
"comment": "Events under this incident have been reviewed ",
"dispositionCategory": "PATCHING",
"status": "CLOSED"
}
}
]