> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.
# List Incidents
Gets a list of incident objects that Microsoft Defender XDR (formerly known as 365 Defender) created to track attacks in an organization.
* **Least privileged** Microsoft Graph permission to access the action via **application**: `SSecurityIncident.Read.All*`.
* **Higher privileged** Microsoft Graph permission to access the action via **application**: `SecurityIncident.ReadWrite.All`.
External Documentation
To learn more, visit the [Microsoft Defender XDR documentation](https://learn.microsoft.com/en-us/graph/api/security-list-incidents?view=graph-rest-1.0\&tabs=http).
## Parameters
| Parameter | Description |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Count | The `$count` query parameter is used to retrieve the count of the total number of items in a collection or matching an expression. For more information on using `$count`, refer to [Microsoft Query Parameters Documentation](https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#count-parameter). |
| Expand | The `$expand` query string parameter is used to include the expanded resource or collection (like `alerts`) referenced by a single relationship (navigation property) in your results. For more information on using `$expand`, refer to [Microsoft Query Parameters Documentation](https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#expand-parameter). |
| Filter | The `$filter` query parameter is used to retrieve a subset of a collection. For more information on using `$filter`, refer to [Microsoft Query Parameters Documentation](https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#filter-parameter).
The following properties are supported:
\* `assignedTo`
\* `classification`
\* `determination`
\* `createdDateTime`
\* `lastUpdateDateTime`
\* `severity`
\* `status` |
| Skip | The `$skip` query parameter is used to set the number of items to skip at the start of a collection. For more information on using `$skip`, refer to [Microsoft Query Parameters Documentation](https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#skip-parameter). |
| Top | The `$top` query parameter is used to specify the number of items to be included in the result. For more information on using `$top`, refer to [Microsoft Query Parameters Documentation](https://learn.microsoft.com/en-us/graph/query-parameters?tabs=http#top-parameter). |
## Example Output
```json theme={"dark"}
{
"value": [
{
"@odata.type": "#microsoft.graph.security.incident",
"id": "2972395",
"incidentWebUrl": "https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7cd011db47",
"redirectIncidentId": null,
"tenantId": "b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c",
"displayName": "Multi-stage incident involving Initial access & Command and control on multiple endpoints reported by multiple sources",
"createdDateTime": "2021-08-13T08:43:35.5533333Z",
"lastUpdateDateTime": "2021-09-30T09:35:45.1133333Z",
"assignedTo": "KaiC@contoso.com",
"classification": "TruePositive",
"determination": "MultiStagedAttack",
"status": "Active",
"severity": "Medium",
"customTags": [
"Demo"
],
"comments": [
{
"comment": "Demo incident",
"createdBy": "DavidS@contoso.com",
"createdTime": "2021-09-30T12:07:37.2756993Z"
}
],
"systemTags": [
"Defender Experts"
],
"description": "Microsoft observed Raspberry Robin worm activity spreading through infected USB on multiple devices in your environment. From available intel, these infections could be a potential precursor activity to ransomware deployment. ...",
"summary": "Defender Experts has identified some malicious activity. This incident has been raised for your awareness and should be investigated as normal."
}
]
}
```
## Workflow Library Example
[List Incidents with Microsoft Defender Xdr and Send Results Via Email](https://library.blinkops.com/workflows/list-incidents-with-microsoft-defender-xdr-and-send-results-via-email)
Preview this Workflow on desktop