Parameters
| Parameter | Description |
|---|---|
| Assignees | A comma-separated list of assigned analyst emails to filter incidents by. |
| End Time | The end of the time range to filter incidents by. Only incidents before this time are returned. |
| Incident IDs | A comma-separated list of incident IDs to filter by. |
| Include AI Summaries | Select to include AI-generated incident summaries in the response. |
| Page ID | The cursor from a previous response’s page_response.next_id, used to fetch the next page. Leave empty to start from the first page. |
| Page Size | The maximum number of incidents to return per page. The API defaults to 25 and accepts up to 200. |
| Policy Severities | Select the policy severities to filter incidents by. |
| Resolution Statuses | Select the resolution statuses to filter incidents by. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Sort By | The field to sort incidents by. Defaults to trigger_time. |
| Start Time | The start of the time range to filter incidents by. Only incidents at or after this time are returned. |
| Users | A comma-separated list of user emails or aliases to filter incidents by, based on who triggered the incident. |
Example Output
{
"resources": [
{
"id": "string",
"status": "open",
"blocked": true,
"trigger_time": "2024-01-01T00:00:00Z",
"event_time": "2024-01-01T00:00:00Z",
"reaction_time": "2024-01-01T00:00:00Z",
"ai_summary": "string",
"ai_severity": "high",
"risk_score": 0,
"created_by": "policy",
"assigned_to": "string",
"close_reason": "",
"close_note": "",
"warning_status": "not_applicable",
"user": {
"id": "string",
"local_id": "string",
"email": "string"
},
"policy": {
"id": "string",
"name": "string",
"severity": "high"
},
"dataset": {
"id": "string",
"name": "string"
},
"event_details": {
"start_event": {
"id": "string",
"timestamp": "2024-01-01T00:00:00Z",
"action": {
"kind": "dlp_scan"
}
},
"end_event": {
"id": "string",
"timestamp": "2024-01-01T00:00:00Z",
"action": {
"kind": "dar_scan"
}
}
},
"event_lineage_id": {
"start_event_id": "string",
"end_event_id": "string"
}
}
],
"page_response": {
"next_id": "string",
"total": 0
}
}
Workflow Library Example
List Incidents with Cyberhaven and Send Results Via Email