# GetIssueDetails

Get specific details about an issue and all related incidents for the issue.

Endpoint: GET /getIssueDetails
Version: 1.0.0
Security: AuthorizationHeader

## Query parameters:

  - `issue_id` (string, required)
    Issue Id to fetch issue details. e.g. 17263-1722579276407

  - `sort_order` (string)
    Sorting order, Default value is DESC.
    Enum: "ASC", "DESC"

  - `sort_by` (string)
    Sort by field for incidents, Default value is last_seen.
    Enum: "incident_id", "incident_risk", "flow_count", "last_seen", "first_seen"

  - `from` (integer)
    Starting point for pagination, Default value 0.

  - `size` (integer)
    Maximum number of records to return for pagination, Default value 1000.

## Response 200 fields (application/json):

  - `success` (boolean)
    Indicates if the request was successful.

  - `results` (array)

  - `results.first_seen` (string)
    Timestamp when the issue was first seen.
    Example: "2024-07-01T10:31:42.000Z"

  - `results.last_seen` (string)
    Timestamp when the issue was last seen.
    Example: "2024-08-01T10:31:42.000Z"

  - `results.risk` (string)
    Risk associated with the issue.
    Enum: "Low", "Medium", "High", "Critical"

  - `results.message` (string)
    Description of the issue.
    Example: "The directory on example.com uses a weak hash algorithm md4 which is not secure and easy to crack."

  - `results.issue_type` (string)
    The issue type associated with the incident.
    Example: "Auth Hash Security"

  - `results.issue_keys` (object)
    Field name(s) on which the related Incidents were grouped to create the issue.
    Example: {"domain":"example.com","hash_algo":"sha256"}

  - `results.incidents_url` (string)
    URL link for the oldest issue incident on console.
    Example: "https://console.authmind.com/issues?q=id%3A3817066"

  - `results.total_flow_count` (integer)
    Total number of flows for the issue.
    Example: 100

  - `results.total_incident_count` (integer)
    Total number of incidents for the issue.
    Example: 1

  - `results.incidents` (array)

  - `results.incidents.asset_hostname` (string)
    Hostname of the asset.
    Example: "example.auto.local"

  - `results.incidents.asset_name` (string)
    Name of the asset.
    Example: "Kerberos App"

  - `results.incidents.asset_port` (integer)
    Port associated with the asset.
    Example: 88

  - `results.incidents.asset_protocol` (string)
    Protocol associated with the asset.
    Example: "Kerberos"

  - `results.incidents.asset_type` (string)
    Type of the asset.
    Example: "App"

  - `results.incidents.first_seen` (string)
    Timestamp when the incident was first seen.
    Example: "2024-08-01T10:31:42.000Z"

  - `results.incidents.flow_count` (integer)
    Total number of flows for the incidents.
    Example: 100

  - `results.incidents.identity_hostname` (string)
    Hostname of the identity.
    Example: "example.auto.local"

  - `results.incidents.identity_name` (string)
    Name of the identity.
    Example: "xyz@example.com"

  - `results.incidents.identity_type` (string)
    Type of the identity.
    Example: "User"

  - `results.incidents.incident_id` (string)
    Incident id.
    Example: 3830559

  - `results.incidents.incident_risk` (string)
    Risk associated with the incident
    Enum: "Low", "Medium", "High", "Critical"

  - `results.incidents.incident_url` (string)
    URL for searching the incident
    Example: "https://console.authmind.com/issues?q=id%3A3830559"

  - `results.incidents.incident_highlights` (string)
    Highlights associated with the incident.
    Example: "<i><b>xyz.example.com</i></b> uses a weak password hash algorithm - <i><b>md4</i></b>"

  - `results.incidents.last_seen` (string)
    Timestamp when the incident was last seen.
    Example: "2024-08-01T10:31:42.000Z"

  - `results.incidents.playbook_name` (string)
    Playbook name corresponding to the incident.
    Example: "Auth Hash Security Playbook"

  - `results.incidents.site_code` (string)
    Code associated with the incident site.
    Example: "AD01"

  - `results.incidents.status` (string)
    Status of the incident.
    Enum: "Open", "Closed", "Resolved"

  - `metadata` (object)
    Response metadata.

## Response 400 fields (application/json):

  - `error` (string)
    Error string if request fails.

  - `success` (boolean)
    Indicates if the request was successful.

  - `results` (string,null)