Retrieve list of incidents.

​
Basic Parameters

ParameterDescription
From DateInclude incidents that were created after the given date. Represent in Unix epoch timestamp.
Incident StatusThe status of the incident.
Range Type-
To DateInclude incidents that were created before the given date. Represent in Unix epoch timestamp.

​
Advanced Parameters

ParameterDescription
MaxThe maximum number of records to return.
OffsetThe offset of the item at which to begin the response.
SortSort the order of the result.

​
Example Output

{
	"status": "OK",
	"messages": [
		"Get incident details for incident ID [2293]"
	],
	"result": {
		"data": {
			"totalIncidents": 1.0,
			"incidentItems": [
				{
					"violatorText": "TESTAUTOCASE2",
					"lastUpdateDate": 1683203728925,
					"violatorId": "TESTAUTOCASE2",
					"incidentType": "HighRiskRTActivityAccount",
					"incidentId": "2293",
					"incidentStatus": "Do Not Change",
					"riskscore": 0.0,
					"assignedGroup": "TestAutomation_Group",
					"priority": "Low",
					"reason": [
						"ResourceType: mvkApr10",
						"Policy: ActAcc4",
						"Threat: Abnormal DNS record type queries"
					],
					"entity": "RTActivityAccount",
					"workflowName": "Test_INC",
					"url": "https://10.0.0.81:8479/Snypr/configurableDashboards/view?&type=incident&id=2293",
					"isWhitelisted": false,
					"watchlisted": false,
					"tenantInfo": {
						"tenantid": 1,
						"tenantname": "Optimus",
						"tenantcolor": "",
						"tenantshortcode": "OP"
					},
					"statusCompleted": false,
					"sandBoxPolicy": false,
					"parentCaseId": "",
					"casecreatetime": 1683187893436,
					"bulkactionallowed": true,
					"type": "HighRiskRTActivityAccount",
					"caseEventStartTime": 1681736367757,
					"solrquery": "index = violation  and @policyname=\"ActAcc4\" and @accountname=\"TESTAUTOCASE2\" and @tenantname=\"Optimus\" and generationtime between \"04/17/2023 07:59:27\" \"05/04/2023 17:33:04\"",
					"policystarttime": 1681736367757,
					"policyendtime": 1683239584337,
					"verboseinfo": "Account TESTAUTOCASE2 performed Logon failure 2 from ipaddress 111.93.188.91"
				}
			]
		}
	}
}

​
Workflow Library Example

List Incidents with Securonix and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop