> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get All Incident Details

Get incident and message details for a specific incident by its ID.

## Basic Parameters

<div className="integrations-table">
  | Parameter   | Description                                                                                                                                                                                      |
  | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
  | End Row     | The last row index to return results until.                                                                                                                                                      |
  | Incident ID | The ID of the incident to get all details for. Can be obtained from the `id` field in the `Get Incidents Summary` action response.                                                               |
  | Sort Params | An array of JSON objects representing sorting criteria.<br /><br />For example:<br /><pre><code>\[<br />  \{<br />    "sort": "desc",<br />    "colId": "createdAt"<br />  }<br />]</code></pre> |
  | Start Row   | The first row index to return results from.                                                                                                                                                      |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter         | Description                                    |
  | ----------------- | ---------------------------------------------- |
  | Confidence Filter | The confidence to filter results by.           |
  | Disposition       | The disposition to filter results by.          |
  | End Time          | The end time of the time range to filter by.   |
  | Source            | The source type to filter results by.          |
  | Start Time        | The start time of the time range to filter by. |
  | Verdict           | The verdict to filter results by.              |
</div>

## Example Output

```json theme={"dark"}
{
	"summary": {
		"id": "63b97d57-0af4-4835-8a3e-8d9fe3949786",
		"sid": 9114748,
		"createdAt": "2024-10-22T23:26:17.239+00:00",
		"updatedAt": "2024-10-22T23:26:24.844+00:00",
		"tenantId": "35873022-0c7d-4118-bca8-ad1eebc682cb",
		"displayld": 781,
		"state": "closed",
		"title": "Message Delivered to bob[@]tricorion[.]tk with link hxxps://theexcelclub[.]com/",
		"closedAt": "2024-10-22T23:26:24.844+00:00",
		"assigned Teamld": "a3672f71-fad5-46e1-a7d5-4d6c2a2b4521",
		"assigned TeamName": "Analyst",
		"falsePositiveCount": 0,
		"messageCount": 2,
		"message SourceData": {
			"hasTapAlert": true,
			"hasAbuseAlert": false,
			"hasSmartSearchImport": false,
			"hasMessageCsvUpload": false
		}
	},
	"comments": [
		{
			"id": "e248ce9d-a1ed-41a1-a277-f6d3efd38ee8",
			"author": "Security Admin User",
			"comment": "This incident has been remediated.",
			"deleted": false,
			"author_id": "a8405822-c771-474c-9154-7d023c710764",
			"tenant_id": "35873022-0c7d-4118-bca8-ad1eebc682cb",
			"comment_id": "5e1bba31-3ce9-4d10-99e6-3644b128abe0",
			"created_at": "2024-11-26T20:51:44.427",
			"updated_at": "2024-11-26T20:51:44.427",
			"incident_id": "e6134e09-6d02-444e-b1a6-7f9d7fe72cc7",
			"activity_type": "comment_addition",
			"activity_details": {}
		}
	],
	"activities": [
		{
			"id": "b0bf87d9-99be-4d8d-8848-4fb9870549a3",
			"content": null,
			"tenant_id": "35873022-0c7d-4118-bca8-ad1eebc682cb",
			"cause_type": "history",
			"comment_id": null,
			"created_at": "2024-10-22T23:26:24.845",
			"updated_at": "2024-10-22T23:26:24.845",
			"incident_id": "63b97d57-0af4-4835-8a3e-8d9fe3949786",
			"occurred at": "2024-10-22T23:26:24.845075",
			"activity_type": "state_change",
			"causing_api_key": null,
			"activity_details": {
				"new_state": "closed",
				"old_state": "open"
			},
			"causing_user_name": null,
			"causing_workflow_name": "Close Incident"
		}
	],
	"total": 2,
	"startRow": 0,
	"endRow": 200,
	"messages": [
		{
			"id": "768c0276-01eb-4e35-b0c3-f97fa9af6b95",
			"sid": 122547986,
			"createdAt": "2024-10-22T23:26:15.976+00:00",
			"updatedAt": "2024-11-26T15:43:28.015+00:00",
			"tenantld": "35873022-0c7d-4118-bca8-ad1eebc682cb",
			"emailld": "9129c5fd-ca52-47a1-b5c3-049ca7d31e4c",
			"messageld": "<DS7PR12MB62861B30D1A2B5714E5473F3AC4C2@DS7PR12MB6286.namprd12.prod.outlook.com>",
			"ppsGuid": "vMojOP7kQU8PdYJIBip0xGnkbo4Krl_j",
			"disposition": "malware",
			"emailSubject": "TDS test mail-3 - PL",
			"emailRecipientId": "768c0276-01eb-4e35-b0c3-f97fa9af6b95",
			"trap Received Time": "2024-10-22T23:26:15.976+00:00",
			"receivedAt": "2024-10-22T23:22:27.760+00:00",
			"remediationStatus": "mailbox_not_found",
			"quarantineStrategy": "forward_and_delete",
			"emailRecipientType": "to",
			"incidentId": "63b97d57-0af4-4835-8a3e-8d9fe3949786",
			"association": "sender_and_subject",
			"mimeContentPresent": false,
			"bodyPresent": false,
			"senderld": "6ba5a494-bedb-4aad-a2f3-a20b8e3887c0",
			"senderAddress": "bad_guy@nefariousdomain.com",
			"senderlp": "148.163.159.21",
			"recipientAddress": "bob@tricorion.tk",
			"lastKnownType": "unknown",
			"tapCleared": false,
			"vip": false,
			"vap": true,
			"reports": 0,
			"messageStatus": {
				"permitted_clicks": 0,
				"message_delivered": true
			},
			"sources": [
				{
					"type": "TapAlert"
				}
			],
			"abuseReporterRank": "not_a_reporter",
			"tap Threat Types": [
				"delivered_url_threat"
			]
		}
	]
}
```

## Workflow Library Example

[Get All Incident Details with Proofpoint Threat Protection and Send Results Via Email](https://library.blinkops.com/workflows/get-all-incident-details-with-proofpoint-threat-protection-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/get-all-incident-details-with-proofpoint-threat-protection-and-send-results-via-email/canvas" />
</div>