--- title: Exabeam Threat Center API slug: connectors/exabeam-threat-center-api docTags: createdAt: 2026-06-09T16:30:30.778Z --- The Exabeam Threat Center API enables organizations to manage and respond to security incidents through advanced threat detection and case management. Exabeam Threat Center is a comprehensive security platform designed to enhance threat detection and response capabilities. This connector allows seamless integration with Swimlane Turbine, enabling users to automate alert and case management tasks such as creating, updating, and retrieving details for alerts and cases. By leveraging this integration, security teams can streamline their workflows, reduce manual effort, and enhance their incident response efficiency within the Swimlane Turbine environment. ### Supported Version - The Exabeam Threat Center connector supports the latest API version. ### Limitations None to date. ## Prerequisites Before you can use the Exabeam Threat Center API connector for Turbine, you'll need access to the Exabeam API. This requires the following: - OAuth 2.0 Client Credentials authentication using the following parameters: - URL: The endpoint for accessing the Exabeam API. - Client ID: The unique identifier for your application. - Client Secret: The secret key associated with your client ID. - Token URL: The URL used to obtain the OAuth token. ## Capabilities This Connector provides the following capabilities: - Create a new Case - Create a Note for a Case - Get Alert Details - Get Case Details - Get Case Notes - Get Threat Summary - Search for Alerts - Search for Cases - Update Alert Details - Update Case Details ### Create a new Case Creates a new case associated with an alert and updates case details like stage, priority, queue, assignee, closedReason. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/threat-center-create-case-v2). ### Create a Note for a Case Add a new note to the specified case. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/threat-center-create-case-note). ### Get Alert Details Get details for a specific alert, as identified by an alert ID. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/threat-center-get-alert-by-id). ### Get Case Details Get details for a specific case, as identified by a case ID. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/threat-center-get-case-by-id). ### Get Case Notes Retrieve a list of notes associated with the specified caseId. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/threat-center-list-case-notes). ### Get Threat Summary Retrieve the Copilot Threat Summary for an individual alert. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/threat-center-get-threat-explanation). ### Search for Alerts Search for alerts that match one or more search criteria. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/threat-center-search-alerts). ### Search for Cases Search for cases that match one or more search criteria. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/threat-center-search-cases). ### Update Alert Details Update details for a specific alert, as identified by an alert ID. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/threat-center-update-alert-by-id). ### Update Case Details Update details for a specific case, as identified by case ID. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/threat-center-update-case-by-id-v2). # Configurations ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token\_url | | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | scope | Permission scopes for this action. | array | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Create a new Case Create a new case in Exabeam Threat Center linked to an alert, updating details such as stage, priority, queue, assignee, and closed reason. Requires alertId and priority. ### Endpoint - **URL:** `/threat-center/v2/cases` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ------------------------------------------------------------------------- | | `priority` | string | Optional | The priority of the case. Allowed values are LOW, MEDIUM, HIGH, CRITICAL. | | `alertId` | string | Optional | Alert UUID. | | `assignee` | string | Optional | Assignee for the case. | | `stage` | string | Optional | Case stage. | | `queue` | string | Optional | Queue assigned for the case. | | `closedReason` | string | Optional | Reason for case closure. | | `supportingReason` | string | Optional | Additional details for the closedReason. | ### Input Example `{"json_body":{"priority":"CRITICAL","alertId":"adafff9a-0669-460b-ba2b-8bffda64a968","assignee":"no-reply@exabeam.com","stage":"CLOSED","queue":"Tier 1","closedReason":"Already Mitigated or Resolved","supportingReason":"The issue identified by the threat has already been addressed or resolved."}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `alertCreationTimestamp` | string | Output field: alertCreationTimestamp | | `alertId` | string | Unique identifier | | `approxLogTime` | string | Time value | | `assignee` | string | Output field: assignee | | `creationTimestamp` | string | Output field: creationTimestamp | | `caseId` | string | Unique identifier | | `caseNumber` | number | Output field: caseNumber | | `creationBy` | string | Output field: creationBy | | `stage` | string | Output field: stage | | `closedReason` | string | Response reason phrase | | `supportingReason` | string | Response reason phrase | | `alertDescription` | string | Output field: alertDescription | | `hasAttachments` | boolean | Output field: hasAttachments | | `isDeleted` | boolean | Output field: isDeleted | | `lastModifiedBy` | string | Output field: lastModifiedBy | | `lastModifiedTimestamp` | string | Output field: lastModifiedTimestamp | | `mitres` | array | Output field: mitres | | `mitres.tacticKey` | string | Output field: mitres.tacticKey | | `mitres.tactic` | string | Output field: mitres.tactic | | `mitres.techniqueKey` | string | Output field: mitres.techniqueKey | | `mitres.technique` | string | Output field: mitres.technique | | `alertName` | string | Name of the resource | | `priority` | string | Output field: priority | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"alertCreationTimestamp":"2024-03-18T09:35:36.179","alertId":"adafff9a-0669-460b-ba2b-8bffda64a968","approxLogTime":"2024-03-18T09:26:17.192","assignee":"no-reply@exabeam.com","creationTimestamp":"2024-06-12T16:41:04.841","caseId":"0ba39dc8-718b-4e71-98ab-81a61a8ecd89","caseNumber":10,"creationBy":"system","stage":"CLOSED","closedReason":"Already Mitigated or Resolved","supportingReason":"The issue identified by the threat has already been addressed ...` ## Create a note for a case Add a new note to a specified case in Exabeam Threat Center API using the caseId as a path parameter. ### Endpoint - **URL:** `/threat-center/v1/cases/{{caseId}}/notes` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------------ | | `path_parameters.caseId` | string | Required | The unique identifier of the case to which the note will be added. | | `note` | string | Optional | The content of the note to be added to the case. | ### Input Example `{"json_body":{"note":"This is a note."},"path_parameters":{"caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","json_body":[{"noteId":"5b6f2b9c-9c7a-4c1a-8b32-2b8e5f1d2a10","caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3","creationBy":"si-user-1@exabeam.com","creationTimestamp":"2024-06-12T09:15:30Z","lastModifiedBy":"si-user-1@exabeam.com","lastModifiedTimestamp":"2024-06-12T09:15:30Z","text":"Investigating login anomalies."},{"noteId":"7a1d8c2e-3b9a-4e15-9b1f-4f2d1a7c3b55","caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3","creationBy":"si-user-2@exabeam.com","creationTimes...` ## Get alert details Retrieve detailed information for a specific alert in Exabeam Threat Center using the alert ID. ### Endpoint - **URL:** `/threat-center/v1/alerts/{{alertId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------- | | `path_parameters.alertId` | string | Required | The unique identifier of the alert for which details are being requested. | ### Input Example `{"path_parameters":{"alertId":"96de8f5c-ae11-48e8-ace9-c38bb6e056d3"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `creationTimestamp` | string | Output field: creationTimestamp | | `alertId` | string | Unique identifier | | `approxLogTime` | string | Time value | | `creationBy` | string | Output field: creationBy | | `alertDescription` | string | Output field: alertDescription | | `lastModifiedBy` | string | Output field: lastModifiedBy | | `lastModifiedTimestamp` | string | Output field: lastModifiedTimestamp | | `mitres` | array | Output field: mitres | | `mitres.tacticKey` | string | Output field: mitres.tacticKey | | `mitres.tactic` | string | Output field: mitres.tactic | | `mitres.techniqueKey` | string | Output field: mitres.techniqueKey | | `mitres.technique` | string | Output field: mitres.technique | | `alertName` | string | Name of the resource | | `priority` | string | Output field: priority | | `riskScore` | number | Score value | | `status` | string | Status value | | `tags` | array | Output field: tags | | `useCases` | array | Output field: useCases | | `products` | array | Output field: products | | `vendors` | array | Output field: vendors | | `srcHosts` | array | Output field: srcHosts | | `srcIps` | array | Output field: srcIps | | `destHosts` | array | Output field: destHosts | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"creationTimestamp":"2024-04-10T09:16:09.915","alertId":"5119d712-1d4c-4da4-9ae5-fd8ea7d88c20","approxLogTime":"2024-04-10T09:11:30.934","creationBy":"system","alertDescription":"Multiple Anomalies detected for user","lastModifiedBy":"si-user-1@exabeam.com","lastModifiedTimestamp":"2024-04-17T08:32:02.522","mitres":[{"tacticKey":"TA0004","tactic":"Privilege Escalation","techniqueKey":"T1078","technique":"Valid Accounts"},{"tacticKey":"TA0011","tactic...` ## Get Case Details Get details for a specific case in Exabeam Threat Center using the provided case ID. ### Endpoint - **URL:** `/threat-center/v1/cases/{{caseId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------------------ | | `path_parameters.caseId` | string | Required | The unique identifier of the case for which details are being requested. | ### Input Example `{"path_parameters":{"caseId":"bfd46b02-9a78-4808-a0d7-9db1a5b6e239"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `alertCreationTimestamp` | string | Output field: alertCreationTimestamp | | `alertId` | string | Unique identifier | | `approxLogTime` | string | Time value | | `assignee` | string | Output field: assignee | | `assigneeId` | string | Unique identifier | | `creationTimestamp` | string | Output field: creationTimestamp | | `caseId` | string | Unique identifier | | `caseNumber` | number | Output field: caseNumber | | `creationBy` | string | Output field: creationBy | | `stage` | string | Output field: stage | | `closedReason` | string | Response reason phrase | | `alertDescription` | string | Output field: alertDescription | | `hasAttachments` | boolean | Output field: hasAttachments | | `isDeleted` | boolean | Output field: isDeleted | | `lastModifiedBy` | string | Output field: lastModifiedBy | | `lastModifiedTimestamp` | string | Output field: lastModifiedTimestamp | | `mitres` | array | Output field: mitres | | `mitres.tacticKey` | string | Output field: mitres.tacticKey | | `mitres.tactic` | string | Output field: mitres.tactic | | `mitres.techniqueKey` | string | Output field: mitres.techniqueKey | | `mitres.technique` | string | Output field: mitres.technique | | `alertName` | string | Name of the resource | | `priority` | string | Output field: priority | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"alertCreationTimestamp":"2024-04-17T11:45:54.421","alertId":"c867bae5-3c21-4c98-a142-953c01dce1df","approxLogTime":"2024-04-17T11:41:47.564","assignee":"si-user-1@exabeam.com","assigneeId":"64f9e3ef1793b179824a8961","creationTimestamp":"2024-04-17T11:48:47.559","caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3","caseNumber":10,"creationBy":"system","stage":"CLOSED","closedReason":"Closed via automation","alertDescription":"Suspicious activity detected ...` ## Get Case Notes Retrieve a list of notes associated with the specified caseId from the Exabeam Threat Center API. ### Endpoint - **URL:** `/threat-center/v1/cases/{{caseId}}/notes` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ---------------------------------------- | | `path_parameters.caseId` | string | Required | Parameters for the Get Case Notes action | ### Input Example `{"path_parameters":{"caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","json_body":[{"noteId":"5b6f2b9c-9c7a-4c1a-8b32-2b8e5f1d2a10","caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3","creationBy":"si-user-1@exabeam.com","creationTimestamp":"2024-06-12T09:15:30Z","lastModifiedBy":"si-user-1@exabeam.com","lastModifiedTimestamp":"2024-06-12T09:15:30Z","text":"Investigating login anomalies."},{"noteId":"7a1d8c2e-3b9a-4e15-9b1f-4f2d1a7c3b55","caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3","creationBy":"si-user-2@exabeam.com","creationTimes...` ## Get threat summary Retrieve the Copilot Threat Summary for an individual alert in Exabeam Threat Center API using the alertId. ### Endpoint - **URL:** `/threat-center/v1/alerts/threat-explainer/prompt` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------ | | `parameters.alertCreationTimestamp` | string | Optional | Parameters for the Get threat summary action | | `alertId` | string | Optional | Unique ID that identifies an alert. | | `prompt` | string | Optional | Provide relevant data or details about a specific threat to provide additional context and input for the AI-generated summary. | ### Input Example `{"parameters":{"alertCreationTimestamp":"2024-06-01T00:00:00Z"},"json_body":{"alertId":"cb00d8ca-a4fa-490b-a5a8-9dca5e61d19b","prompt":"When is the rule WEB-OC-F triggered?"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"message":"The rule WEB-OC-F is triggered when a web request results in a **failure**. Spec..."}}` ## Search for alerts Search for alerts in Exabeam Threat Center API that match specified criteria, including startTime, endTime, fields, and filter. ### Endpoint - **URL:** `/threat-center/v1/search/alerts` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------- | | `limit` | number | Optional | Limit the number of results returned from the search request. | | `orderBy` | array | Optional | Order results by a specified field in ASC or DESC order. | | `startTime` | string | Optional | Timestamp to start the search (ISO-8601 format) | | `endTime` | string | Optional | Timestamp to end the search (ISO-8601 format) | | `filter` | string | Optional | Filter for specific results. | | `fields` | array | Optional | List of fields to be returned from the search. Use \* to return all applicable fields. | ### Input Example `{"json_body":{"limit":3000,"orderBy":["riskScore DESC"],"startTime":"2024-05-01T00:00:00Z","endTime":"2024-06-01T00:00:00Z","filter":"caseId:null","fields":["alert_123"]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | --------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `timeStartedMillis` | number | Output field: timeStartedMillis | | `timeCompletedMillis` | number | Output field: timeCompletedMillis | | `rows` | array | Output field: rows | | `totalRows` | number | Output field: totalRows | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"timeStartedMillis":0,"timeCompletedMillis":0,"rows":[{}],"totalRows":0}}` ## Search for Cases Search for cases in Exabeam Threat Center API that match specified criteria, including startTime, endTime, fields, and filter. ### Endpoint - **URL:** `/threat-center/v1/search/cases` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------- | | `limit` | number | Optional | Limit the number of results returned from the search request. | | `orderBy` | array | Optional | Order results by a specified field in ASC or DESC order. | | `fields` | array | Optional | List of fields to be returned from the search. Use \* to return all applicable fields. | | `startTime` | string | Optional | Timestamp to start the search (ISO-8601 format) | | `endTime` | string | Optional | Timestamp to end the search (ISO-8601 format) | | `filter` | string | Optional | Filter for specific results. | ### Input Example `{"json_body":{"limit":3000,"orderBy":["riskScore DESC"],"fields":["alert_123"],"startTime":"2024-05-01T00:00:00Z","endTime":"2024-06-01T00:00:00Z","filter":"NOT stage:\"CLOSED\""}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | --------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `timeStartedMillis` | number | Output field: timeStartedMillis | | `timeCompletedMillis` | number | Output field: timeCompletedMillis | | `rows` | array | Output field: rows | | `totalRows` | number | Output field: totalRows | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"timeStartedMillis":0,"timeCompletedMillis":0,"rows":[{}],"totalRows":0}}` ## Update alert details Update details for a specific alert in Exabeam Threat Center using the alert ID as a path parameter. ### Endpoint - **URL:** `/threat-center/v1/alerts/{{alertId}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ----------------------------------------------------- | | `path_parameters.alertId` | string | Required | Unique ID that identifies an alert. | | `alertDescription` | string | Optional | Alert description in either plaintext or HTML format. | | `alertName` | string | Optional | Name of the alert. | | `priority` | string | Optional | Priority level of the alert. | | `tags` | array | Optional | List of tags associated with the alert. | ### Input Example `{"json_body":{"alertDescription":"Suspicious activity detected on host","alertName":"Multiple Anomalies Detected","priority":"CRITICAL","tags":["Log4j"]},"path_parameters":{"alertId":"eab6bb52-7686-43c2-ba7e-304cae0b75dd"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `creationTimestamp` | string | Output field: creationTimestamp | | `alertId` | string | Unique identifier | | `approxLogTime` | string | Time value | | `creationBy` | string | Output field: creationBy | | `alertDescription` | string | Output field: alertDescription | | `lastModifiedBy` | string | Output field: lastModifiedBy | | `lastModifiedTimestamp` | string | Output field: lastModifiedTimestamp | | `mitres` | array | Output field: mitres | | `mitres.tacticKey` | string | Output field: mitres.tacticKey | | `mitres.tactic` | string | Output field: mitres.tactic | | `mitres.techniqueKey` | string | Output field: mitres.techniqueKey | | `mitres.technique` | string | Output field: mitres.technique | | `alertName` | string | Name of the resource | | `priority` | string | Output field: priority | | `riskScore` | number | Score value | | `status` | string | Status value | | `tags` | array | Output field: tags | | `useCases` | array | Output field: useCases | | `products` | array | Output field: products | | `vendors` | array | Output field: vendors | | `srcHosts` | array | Output field: srcHosts | | `srcIps` | array | Output field: srcIps | | `destHosts` | array | Output field: destHosts | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"creationTimestamp":"2024-03-18T09:40:01.972","alertId":"eab6bb52-7686-43c2-ba7e-304cae0b75dd","approxLogTime":"2024-03-18T09:30:42.312","creationBy":"system","alertDescription":"Suspicious activity detected on host","lastModifiedBy":"si-user-1@exabeam.com","lastModifiedTimestamp":"2024-05-29T12:26:17.670","mitres":[{}],"alertName":"Failed login attempts to application initiated multiple times","priority":"LOW","riskScore":10,"status":"READ","tags":[...` ## Update Case Details Update details for a specific case in Exabeam Threat Center using the case ID as a path parameter. ### Endpoint - **URL:** `/threat-center/v2/cases/{{caseId}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ----------------------------------------------------------- | | `path_parameters.caseId` | string | Required | Unique ID that identifies a case. | | `alertDescription` | string | Optional | Alert description in either plaintext or HTML format. | | `alertName` | string | Optional | Name of the alert. | | `priority` | string | Optional | Priority level of the case. | | `tags` | array | Optional | Tags to group cases. | | `stage` | string | Optional | Current stage of the case. | | `closedReason` | string | Optional | Reason for closing the case, if applicable. | | `supportingReason` | string | Optional | Additional context for the closed reason, if applicable. | | `assignee` | string | Optional | User assigned to the case for investigation and resolution. | | `queue` | string | Optional | Queue for the case. | ### Input Example `{"json_body":{"alertDescription":"Suspicious activity detected on host","alertName":"Multiple Anomalies Detected","priority":"CRITICAL","tags":["Log4j"],"stage":"INVESTIGATION","closedReason":"False Positive or Duplicate","supportingReason":"The issue identified by the threat has already been addressed or resolved.","assignee":"si-user-1@exabeam.com","queue":"Tier 1"},"path_parameters":{"caseId":"ab10c168-7f62-4892-b8e7-d4ee73c82f08"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `alertCreationTimestamp` | string | Output field: alertCreationTimestamp | | `alertId` | string | Unique identifier | | `approxLogTime` | string | Time value | | `assignee` | string | Output field: assignee | | `creationTimestamp` | string | Output field: creationTimestamp | | `caseId` | string | Unique identifier | | `caseNumber` | number | Output field: caseNumber | | `creationBy` | string | Output field: creationBy | | `stage` | string | Output field: stage | | `closedReason` | string | Response reason phrase | | `supportingReason` | string | Response reason phrase | | `alertDescription` | string | Output field: alertDescription | | `hasAttachments` | boolean | Output field: hasAttachments | | `isDeleted` | boolean | Output field: isDeleted | | `lastModifiedBy` | string | Output field: lastModifiedBy | | `lastModifiedTimestamp` | string | Output field: lastModifiedTimestamp | | `mitres` | array | Output field: mitres | | `mitres.tacticKey` | string | Output field: mitres.tacticKey | | `mitres.tactic` | string | Output field: mitres.tactic | | `mitres.techniqueKey` | string | Output field: mitres.techniqueKey | | `mitres.technique` | string | Output field: mitres.technique | | `alertName` | string | Name of the resource | | `priority` | string | Output field: priority | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"alertCreationTimestamp":"2024-04-05T20:11:41.528","alertId":"4331d707-7cbd-4d48-a689-cb230827a442","approxLogTime":"2024-04-05T20:03:000","assignee":"no-reply@exabeam.com","creationTimestamp":"2024-04-05T20:17:41.226","caseId":"ab10c168-7f62-4892-b8e7-d4ee73c82f08","caseNumber":10,"creationBy":"system","stage":"CLOSED","closedReason":"Already Mitigated or Resolved","supportingReason":"The issue identified by the threat has already been addressed or ...` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |