NetwitnessSAListIncidents

commonfields:
  id: NetwitnessSAListIncidents
  version: -1
name: NetwitnessSAListIncidents
script: ''
type: python
subtype: python3
tags:
- RSA NetWitness Security Analytics
comment: List NetWitness SA incidents. Filtering and sorting the list is also supported (see optional arguments).
system: true
args:
- name: query
  description: 'If query provided all other parameters ignored. Query should contain page, limit, start, sort and filter, joined by &, For example: page=1&start=0&limit=100&sort=[{"property":"created","direction":"DESC"}]&filter=[{"property":"created","value":[851171984031,1482323984031]}].'
- name: page
  description: The default is 1. Indicates the page number of incidents.
- name: start
  description: The default is 0. Indicates the start index of incident in page.
- name: limit
  description: The default is 100. Limits the number of incidents per page.
- name: sort
  description: 'By default sorts by "created" field in "DESC" order. Example: "[{"property":"created","direction":"DESC"}]".'
- name: filter
  description: 'By default filters by "created" from 1996 to this date. Example: "[{"property":"id", "value":"INC-21"}]".'
- name: incidentManagementId
  description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running nw-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
scripttarget: 0
dependson:
  must:
  - netwitness-im-list-incidents
timeout: 0s
fromversion: 5.0.0
dockerimage: demisto/python3:3.12.13.10116658
tests:
- No tests (auto formatted)
skipprepare:
- script-name-incident-to-alert