List Open Impersonation Incidents

Gets a list of impersonation only incidents which are found on Threat protection dashboard (HOME > Incident Summary >Mailbox Anomalies).

Parameters

Parameter	Description
Company ID	The ID of the company. Can be found under Account Settings -> General & Security -> Company ID.
Period	The period over which to filter the resulting incidents.Possible values: 0 - Last 24 hours, 1 - Last 7 days, 2 - Last 90 days, 3 - Last 180 days, 4 - Last 360 days, 5 - Current year to date, 6 - All time.

Example Output

{
    "incidents": [],
    "messages": []
}

Workflow Library Example

List Open Impersonation Incidents with Ironscales and Send Results Via Email

Preview this Workflow on desktop