> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Incident Reports

Retrieve a list of incident reports showing detected threats and recommended remediations.

<Note>
  External Documentation

  To learn more, visit the [Huntress documentation](https://api.huntress.io/docs#rest-api/tag/incident-reports/GET/v1/incident_reports).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter        | Description                                                                                                       |
  | ---------------- | ----------------------------------------------------------------------------------------------------------------- |
  | Indicator Type   | Select the indicator type to filter the incident reports by.                                                      |
  | Limit            | The maximum number of results to return per page. Defaults to `10`, with a minimum of `1` and a maximum of `500`. |
  | Page Token       | The token used to retrieve the next page of results.                                                              |
  | Return All Pages | Automatically fetch all resources, page by page.                                                                  |
  | Severity         | Select the severity to filter the results by.                                                                     |
  | Sort Direction   | Select the sort direction for the results.                                                                        |
  | Sort Field       | Select the field to sort the results by.                                                                          |
  | Status           | Select the status to filter the incident reports by.                                                              |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter       | Description                                                                                            |
  | --------------- | ------------------------------------------------------------------------------------------------------ |
  | Agent ID        | The ID of the agent to filter the incident reports by. Can be obtained using the `List Agents` action. |
  | Organization ID | The ID of the organization to filter the results by.                                                   |
  | Platform        | Select the platform to filter the incident reports by.                                                 |
</div>

## Example Output

```json theme={"dark"}
{
	"incident_reports": [
		{
			"id": 1,
			"account_id": 5,
			"agent_id": 12,
			"body": "<Content>",
			"closed_at": "2022-03-15T14:22:00Z",
			"indicator_counts": {
				"footholds": 1,
				"monitored_files": 0,
				"process_detections": 0,
				"ransomware_canaries": 0,
				"antivirus_detections": 0
			},
			"indicator_types": [
				"footholds"
			],
			"organization_id": 4,
			"platform": "windows",
			"remediations": {
				"total_count": 1,
				"has_more": false,
				"items": [
					{
						"id": 1,
						"type": "manual",
						"action": "Delete File",
						"parameters": [
							{
								"name": "path",
								"description": "c:\\windows\\system32\\tasks\\malicious_task"
							}
						],
						"status": "completed",
						"approved_at": "2025-06-26T18:57:03Z",
						"approved_by": {
							"id": "123123",
							"email": "john.smith@example.com",
							"name": "John smith"
						},
						"completed_at": "2025-06-26T18:57:03Z"
					}
				]
			},
			"sent_at": "2022-03-01T21:00:00Z",
			"severity": "low",
			"status": "closed",
			"status_updated_at": "2022-03-15T14:22:00Z",
			"subject": "LOW - Incident on laptop01 (Test)",
			"summary": "Huntress detected a malicious scheduled task on this host. We recommend removing the file and scheduled task listed in the remediation steps below.",
			"updated_at": "2022-03-01T20:31:30Z"
		}
	],
	"pagination": {
		"next_page_url": "string",
		"next_page_token": "string"
	}
}
```

## Workflow Library Example

[List Incident Reports with Huntress and Send Results Via Email](https://library.blinkops.com/workflows/list-incident-reports-with-huntress-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/list-incident-reports-with-huntress-and-send-results-via-email/canvas" />
</div>