> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Perform Incident Action

Update the status or other aspects of one or more incidents. You can modify a maximum of 5,000 incidents in a request.

<Note>
  External Documentation

  To learn more, visit the [CrowdStrike documentation](https://falcon.us-2.crowdstrike.com/documentation/page/adf2fd07/incident-detection-and-alert-monitoring-apis#z9f33a3f).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
  | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
  | Action Parameters | A comma-separated list of the parameters for the prospective action.<br />Each action\_parameter value will be applied to each incident whose id is listed in `Incident IDs`.<br /><br />Action Parameters Name:<br /><br />- `add_tag`: Adds the associated value as a new tag on all the incidents of the Incident IDs list.<br /><br />- `delete_tag`: Deletes tags matching the value from all the incidents in the Incident IDs list.<br /><br />- `unassign`: Unassigns all users from all of the incidents in the Incident IDs list.<br />  This action does not require a value parameter. For example:<br />  "action\_parameters":<br />  <pre><code><br />  \[<br />    \{"name": "unassign"}<br />  ]<br /></code></pre><br />- `update_name`: Updates the name to the parameter value of all the incidents in the Incident IDs list.<br /><br />- `update_assigned_to_v2`: Assigns the user matching the UUID in the parameter value to all of the incidents in the Incident IDs list.<br /><br />  Tip: For information on getting the UUID of a user, see [Find existing users](https://falcon.us-2.crowdstrike.com/documentation/page/b99d60a0/users-and-roles-apis).<br /><br />- `update_description`: Updates the description to the parameter value of all the incidents listed in the Incident IDs list.<br /><br />- `update_status`: Updates the status to the parameter value of all the incidents in the Incident IDs list.<br />  Valid status values are 20, 25, 30, or 40:<br />  - 20: New<br />  - 25: Reopened<br />  - 30: In Progress<br />  - 40: Closed |
  | Incident IDs      | A comma-separated list of incident IDs to perform the action on. Can be obtained via the `List Incidents` action.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
</div>

## Example Output

```json theme={"dark"}
{
	"meta": {
		"query_time": 0.480404495,
		"powered_by": "incident-api",
		"trace_id": "12fe5621-0c10-4b07-9277-5fc045a84cb0"
	},
	"resources": [],
	"errors": []
}
```

## Workflow Library Example

[Perform Incident Action with Crowdstrike and Send Results Via Email](https://library.blinkops.com/workflows/perform-incident-action-with-crowdstrike-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/perform-incident-action-with-crowdstrike-and-send-results-via-email/canvas" />
</div>