Alert Context Tags

REST API operations for alert context tags

Overview

Use these API operations to interact with alert context tags in Panther.

To call the API, see the How to use the Panther REST API instructions—including directions for how to invoke it directly from this documentation page.

Required permissions

• For GET operations, your API token must have the Read Alerts permission.

• For POST, DELETE, and PATCH operations, your API token must have the Manage Alerts permission.

Operations

List all context tags

get

Returns all context tags, both managed (system-defined) and custom (user-defined)

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Query parameters

cursorstringOptional

Pagination token from a previous request

limitinteger · int64 · min: 1 · max: 2000Optional

Maximum number of results to return

Default: 2000

managedbooleanOptional

Filter by tag type: true for managed tags only, false for custom tags only, omit for all tags

Responses

200

OK response.

application/json

Response for listing context tags

nextstringOptional

Pagination token for the next page of results

400

bad_request: Bad Request response.

application/json

get/alert-context-tags

HTTPcURLJavaScriptPython

GET /alert-context-tags HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

{
  "next": "text",
  "results": [
    {
      "category": "text",
      "managed": true,
      "tag": "text"
    }
  ]
}

Create a custom context tag

post

Creates a new custom context tag. Returns 409 Conflict if the tag already exists.

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Body

application/json

Request to create a custom context tag

tagstring · min: 1 · max: 30Required

The tag value to create

Pattern: ^[a-z0-9_-]+$

Responses

201

Created response.

No content

400

bad_request: Bad Request response.

application/json

409

exists: Conflict response.

application/json

post/alert-context-tags

HTTPcURLJavaScriptPython

POST /alert-context-tags HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 14

{
  "tag": "text"
}

No content

Delete a custom context tag

delete

Deletes a custom context tag. Managed tags cannot be deleted.

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

tagstring · min: 1 · max: 30Required

The tag value to delete

Pattern: ^[a-z0-9_-]+$

Responses

204

No Content response.

No content

400

bad_request: Bad Request response.

application/json

delete/alert-context-tags/{tag}

HTTPcURLJavaScriptPython

DELETE /alert-context-tags/{tag} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

No content

Rename a custom context tag

patch

Atomically renames a custom context tag. Returns 404 if the tag doesn't exist, 409 if the target tag already exists.

Authorizations

ApiKeyAuth

X-API-KeystringRequired

Path parameters

tagstring · min: 1 · max: 30Required

The current tag value to rename

Pattern: ^[a-z0-9_-]+$

Body

application/json

Request to rename a custom context tag

tagstring · min: 1 · max: 30Required

The new tag value

Pattern: ^[a-z0-9_-]+$

Responses

204

No Content response.

No content

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

409

exists: Conflict response.

application/json

patch/alert-context-tags/{tag}

HTTPcURLJavaScriptPython

PATCH /alert-context-tags/{tag} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 14

{
  "tag": "text"
}

No content