Basic Parameters
| Parameter | Description |
|---|---|
| Company ID | The ID of the company. |
| End Date | The date to filter incidents to. |
| Limit | The maximum number of results to return per page. Maximum value is 100. |
| Page | The page number to return. Starts at 1. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Start Date | The date to filter incidents from. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Alarm IDs | A comma-separated list of alarm IDs to filter results by. |
| Alarm Main Types | Select the main alarm types to filter results by. |
| Alarm Sub Types | Select the alarm subtypes to filter results by. |
| Alarm Title | Select the alarm titles to filter results by. |
| Alarm Type IDs | A comma-separated list of alarm type IDs to filter results by. |
| Assignees | A comma-separated list of assigned users to filter results by. |
| Excluded Alarm Main Types | Select the main alarm types to exclude from results. |
| Excluded Alarm Sub Types | A comma-separated list of alarm subtypes to exclude from results. |
| Excluded Alarm Title | Select the alarm titles to exclude from results. |
| Excluded Alarm Type IDs | A comma-separated list of alarm type IDs to exclude from results. |
| Excluded Assignees | A comma-separated list of assigned users to exclude from results. |
| Excluded Status | The incident status to exclude from results. |
| Excluded Tags | A comma-separated list of tags to exclude from results. |
| Include Ai Decision | Select to include the AI decision, such as AI decision FP or True Positive. |
| Include Alarm Details | Select to include alarm details. |
| Include Rule Details | Select to include rule details in the response when available. |
| Notification IDs | A comma-separated list of notification IDs to filter results by. |
| Rule IDs | A comma-separated list of rule IDs to filter results by. |
| Severities | Select the incident severity to filter results by. |
| Status | Select the incident status to filter results by. |
| Tags | A comma-separated list of tags to filter results by. |
Example Output
{
"is_success": true,
"message": "Success",
"response_code": 200,
"data": [
{
"alarm_id": 51681742,
"alarm_asset": "TESTSOCRadar",
"alarm_assignees": [
"string"
],
"alarm_related_assets": [
"string"
],
"alarm_related_entities": [
"string"
],
"alarm_risk_level": "HIGH",
"alarm_text": "Detected stolen credentials from infected system",
"alarm_response": "Isolate system and investigate",
"alarm_type_details": {
"alarm_compliance_list": [
{
"control_item": "string",
"description": "string",
"name": "string"
}
],
"alarm_default_mitigation_plan": "string",
"alarm_default_risk_level": "string",
"alarm_detection_and_analysis": "string",
"alarm_generic_title": "string",
"alarm_main_type": "string",
"alarm_sub_type": "string"
},
"content": {
"antivirus": "string",
"app": "string",
"compromised_domains": "string",
"compromised_emails": "string",
"compromised_ips": "string",
"computer_name": "string",
"credential_details": [
{
"Password": "string",
"URL": "string",
"User": "string"
}
],
"guid": "string",
"hwid": "string",
"log_content_link": "string",
"log_date": "string",
"mac_address": "string",
"machine_id": "string",
"malware_family": "string",
"malware_path": "string",
"socradar_process_date": "string",
"source_full_content": "string",
"timezone": "string",
"uac": "string",
"username": "string"
},
"date": "2026-07-16T18:01:59.572Z",
"extra": [
{}
],
"history": [
{
"action_taken_by": "string",
"action_type": "string",
"date": "2026-07-16T18:01:59.572Z",
"description": "string"
}
],
"is_approved": true,
"last_notification_date": "2026-07-16T18:01:59.572Z",
"notes": [
{}
],
"notification_id": 0,
"status": "OPEN",
"tags": [
"string"
]
}
]
}
Workflow Library Example
List Incidents with Socradar and Send Results Via Email