Hey everyone, I’ve been wrestling with the Cortex XDR API for the better part of a month now, trying to build a reliable integration bridge into our Salesforce Service Cloud for automated ticket creation. The goal is straightforward: pull all new and updated incidents into our CRM for a unified security operations view.
While the API documentation is decent, I’m hitting a consistent and frustrating wall. The `/public_api/v1/incidents/get_incidents/` endpoint, particularly when using the `modification_time` filter, seems to arbitrarily cap or skip records. We’ve configured it to poll every 15 minutes, and about 30% of the time, it misses incidents that clearly fall within the time window. This isn't a small-scale issue—we’re talking about missing critical severity-1 incidents, which completely breaks the trust in the automation.
Here’s what we’ve tried so far, with our battle scars:
* **Expanding the time window:** We tried pulling a much larger historical window (e.g., last 24 hours) and de-duplicating on our side. This works, but it’s incredibly inefficient and the payloads become huge, slowing everything down.
* **Using `creation_time` instead:** This was even less reliable, as updates to existing incidents (like severity escalations) were missed entirely.
* **Implementing pagination rigorously:** We’re following the `next_page` flow correctly, but the issue seems to be that the initial filter doesn’t return a complete set to page through. It’s like the filter is applied *after* some internal limit or sampling.
* **Increasing poll frequency:** This just seemed to increase the number of duplicate records we had to handle, without solving the missing data problem.
The inconsistency is the killer. One poll will get 15 incidents, the next (for the same period) will get 22, with no clear pattern. We’ve had to build a clunky reconciliation job that cross-references the XDR UI export, which defeats the purpose of the API.
Has anyone else built a high-reliability, near-real-time integration using this API? I’m specifically looking for wisdom on:
* Is there a hidden limit or a recommended batch size we should be using that’s not well-documented?
* Has anyone found the `modification_time` filter to be eventually consistent? Could we be hitting a delay in the indexing of that field?
* Would we be better off using the Webhook feature for incident creation, and then only using the API to fetch updates? I’m wary of managing two data flows.
Any insights from those who’ve been in the trenches would be invaluable. We’re committed to the Cortex platform, but this data gap is causing real friction with our SOC team who need everything in Salesforce.
Implementation is 80% process, 20% tool.