Basic Parameters
| Parameter | Description |
|---|---|
| End Row | The last row index to return results until. |
| Incident Display IDs | A comma-separated list of incident display IDs to filter by. |
| Sort Params | An array of JSON objects representing sorting criteria. For example: |
| Start Row | The first row index to return results from. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Confidence Filter | The confidence to filter results by. |
| Disposition | The disposition to filter results by. |
| End Time | The end time of the time range to filter by. |
| Priority | The priority to filter the results by. |
| Source | The source type to filter results by. |
| Start Time | The start time of the time range to filter by. |
| State Filter | The state of the incidents to filter by. |
| Verdict | The verdict to filter results by. |
Example Output
{
"total": 1,
"startRow": 0,
"endRow": 1,
"incidents": [
{
"id": "63b97d57-0af4-4835-8a3e-8d9fe3949786",
"sid": 9114748,
"createdAt": "2024-10-22T23:26:17.239+00:00",
"updatedAt": "2024-10-22T23:26:24.844+00:00",
"tenantId": "35873022-0c7d-4118-bca8-ad1eebc682cb",
"closedAt": "2024-10-22T23:26:24.844+00:00",
"displayId": 781,
"title": "Message Delivered to bob[@]tricorion[.]tk with link hxxps://theexcelclub[.]com/",
"state": "closed",
"assignedTeamName": "Analyst",
"assignedTeamId": "a3672f71-fad5-46e1-a7d5-4d6c2a2b4521",
"messageCount": 2,
"vap": true,
"vip": false,
"abuseSourceIds": [],
"sourceTypes": [
"tap_alert"
],
"sourcesData": [
{
"type": "TapAlert"
}
],
"commentCount": 1,
"dispositions": [
"malware"
],
"clearVerdicts": [],
"clearConfidences": []
}
]
}
Workflow Library Example
Get Incidents Summary with Proofpoint Threat Protection and Send Results Via Email