List Escalations - BlinkOps Documentation

Retrieve a list of escalations requiring administrator attention, such as false positive reports, threat clarifications, and VPN logins.

External DocumentationTo learn more, visit the Huntress documentation.

Parameters

Parameter	Description
Limit	The maximum number of results to return per page. Defaults to `10`, with a minimum of `1` and a maximum of `500`.
Organization ID	The ID of the organization to filter the results by.
Page Token	The token used to retrieve the next page of results.
Return All Pages	Automatically fetch all resources, page by page.
Severity	Select the severity to filter the results by.
Sort Direction	Select the sort direction for the results.
Sort Field	Select the field to sort the results by.
Status	Select the status to filter the escalations by.
Subtype	The escalation subtype to filter the results by.

Example Output

{
	"escalations": [
		{
			"id": 84938,
			"account": {
				"id": 1,
				"name": "Your Account Name"
			},
			"organizations": [
				{
					"id": 1234,
					"name": "ExampleCo"
				}
			],
			"created_at": "2025-09-05T18:20:34Z",
			"resolved_at": "2025-09-05T18:20:34Z",
			"severity": "low",
			"status": "resolved",
			"subject": "Defender Disabled",
			"subtype": "US",
			"type": "Environmental Issue",
			"updated_at": "2025-09-05T18:20:34Z"
		}
	],
	"pagination": {
		"next_page_url": "string",
		"next_page_token": "string"
	}
}

Workflow Library Example

List Escalations with Huntress and Send Results Via Email

Preview this Workflow on desktop