> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Incidents

Retrieve a list of incidents.

## Basic Parameters

<div className="integrations-table">
  | Parameter        | Description                                                               |
  | ---------------- | ------------------------------------------------------------------------- |
  | Company ID       | The ID of the company.                                                    |
  | End Date         | The date to filter incidents to.                                          |
  | Limit            | The maximum number of results to return per page. Maximum value is `100`. |
  | Page             | The page number to return. Starts at `1`.                                 |
  | Return All Pages | Automatically fetch all resources, page by page.                          |
  | Start Date       | The date to filter incidents from.                                        |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter                 | Description                                                                       |
  | ------------------------- | --------------------------------------------------------------------------------- |
  | Alarm IDs                 | A comma-separated list of alarm IDs to filter results by.                         |
  | Alarm Main Types          | Select the main alarm types to filter results by.                                 |
  | Alarm Sub Types           | Select the alarm subtypes to filter results by.                                   |
  | Alarm Title               | Select the alarm titles to filter results by.                                     |
  | Alarm Type IDs            | A comma-separated list of alarm type IDs to filter results by.                    |
  | Assignees                 | A comma-separated list of assigned users to filter results by.                    |
  | Excluded Alarm Main Types | Select the main alarm types to exclude from results.                              |
  | Excluded Alarm Sub Types  | A comma-separated list of alarm subtypes to exclude from results.                 |
  | Excluded Alarm Title      | Select the alarm titles to exclude from results.                                  |
  | Excluded Alarm Type IDs   | A comma-separated list of alarm type IDs to exclude from results.                 |
  | Excluded Assignees        | A comma-separated list of assigned users to exclude from results.                 |
  | Excluded Status           | The incident status to exclude from results.                                      |
  | Excluded Tags             | A comma-separated list of tags to exclude from results.                           |
  | Include Ai Decision       | Select to include the AI decision, such as `AI decision` `FP` or `True Positive`. |
  | Include Alarm Details     | Select to include alarm details.                                                  |
  | Include Rule Details      | Select to include rule details in the response when available.                    |
  | Notification IDs          | A comma-separated list of notification IDs to filter results by.                  |
  | Rule IDs                  | A comma-separated list of rule IDs to filter results by.                          |
  | Severities                | Select the incident severity to filter results by.                                |
  | Status                    | Select the incident status to filter results by.                                  |
  | Tags                      | A comma-separated list of tags to filter results by.                              |
</div>

## Example Output

```json theme={"dark"}
{
	"is_success": true,
	"message": "Success",
	"response_code": 200,
	"data": [
		{
			"alarm_id": 51681742,
			"alarm_asset": "TESTSOCRadar",
			"alarm_assignees": [
				"string"
			],
			"alarm_related_assets": [
				"string"
			],
			"alarm_related_entities": [
				"string"
			],
			"alarm_risk_level": "HIGH",
			"alarm_text": "Detected stolen credentials from infected system",
			"alarm_response": "Isolate system and investigate",
			"alarm_type_details": {
				"alarm_compliance_list": [
					{
						"control_item": "string",
						"description": "string",
						"name": "string"
					}
				],
				"alarm_default_mitigation_plan": "string",
				"alarm_default_risk_level": "string",
				"alarm_detection_and_analysis": "string",
				"alarm_generic_title": "string",
				"alarm_main_type": "string",
				"alarm_sub_type": "string"
			},
			"content": {
				"antivirus": "string",
				"app": "string",
				"compromised_domains": "string",
				"compromised_emails": "string",
				"compromised_ips": "string",
				"computer_name": "string",
				"credential_details": [
					{
						"Password": "string",
						"URL": "string",
						"User": "string"
					}
				],
				"guid": "string",
				"hwid": "string",
				"log_content_link": "string",
				"log_date": "string",
				"mac_address": "string",
				"machine_id": "string",
				"malware_family": "string",
				"malware_path": "string",
				"socradar_process_date": "string",
				"source_full_content": "string",
				"timezone": "string",
				"uac": "string",
				"username": "string"
			},
			"date": "2026-07-16T18:01:59.572Z",
			"extra": [
				{}
			],
			"history": [
				{
					"action_taken_by": "string",
					"action_type": "string",
					"date": "2026-07-16T18:01:59.572Z",
					"description": "string"
				}
			],
			"is_approved": true,
			"last_notification_date": "2026-07-16T18:01:59.572Z",
			"notes": [
				{}
			],
			"notification_id": 0,
			"status": "OPEN",
			"tags": [
				"string"
			]
		}
	]
}
```

## Workflow Library Example

[List Incidents with Socradar and Send Results Via Email](https://library.blinkops.com/workflows/list-incidents-with-socradar-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/list-incidents-with-socradar-and-send-results-via-email/canvas" />
</div>