Get Incidents - BlinkOps Documentation

Retrieves a list of the incidents by provided filters (maximum of 10,000 incidents per response). The list of returned incidents can contain one type of the two options: DLP incidents (INCIDENTS) or Discovery incidents (DISCOVERY).

Basic Parameters

Parameter	Description
Filter By ID List	A Comma separated array of incident IDs to filter the results by.
Filter Incidents From Date	Include incidents that were created after the given date.
Filter Incidents Until Date	Include incidents that were created before the given date.
Incident Type	The incident type.

Advanced Parameters

Parameter	Description
Filter By Action	Filter by the action performed by Forcepoint in response to the incident.
Filter By Policy	Filter by the policy that triggered the incident.
Filter By Severity	Filter by the incident severity.
Filter By Status	Filter by the incident status.
Sort By Date	Sort the results by date.

Example Output

{
	"incidents": [
		{
			"id": 373623,
			"severity": "HIGH",
			"action": "RELEASED",
			"tag": "Tag",
			"status": "Closed",
			"source": {
				"email_address": "test2@aaa.com"
			},
			"event_id": "7728775614896485765",
			"maximum_matches": 13,
			"transaction_size": 2632,
			"analyzed_by": "Policy Engine  1272021",
			"ignored_incidents": false,
			"event_time": "19/10/2021 10:12:02",
			"incident_time": "19/10/2021 10:12:02",
			"channel": "EMAIL",
			"policies": "Credit Cards; PCI",
			"partition_index": 20211019,
			"destination": "aaa@aaa.net",
			"detected_by": "Protector on 1272021",
			"details": "Automatic Email Subject with",
			"released_incident": true,
			"violation_triggers": 2,
			"file_name": "visa.txt - 1.09 KB"
		}
	],
	"total_count": 1,
	"total_returned": 1
}