Skip to main content
Retrieve a list of incidents. Note: By default, incidents from the last 30 days are returned. Use the filtering parameters to modify the date range.
External DocumentationTo learn more, visit the Vega documentation.

Basic Parameters

ParameterDescription
Incident IDsA comma-separated list of incident IDs to filter by.
Incident NamesA comma-separated list of incident names to filter by.
LimitThe maximum number of results to return per page. The default is 100.
OffsetThe number of results to skip for pagination.
Return All PagesAutomatically fetch all resources, page by page.
SeveritiesSelect the severities to filter by.
StatusesSelect the statuses to filter by.
VerdictsSelect the verdicts to filter by.

Advanced Parameters

ParameterDescription
FromThe start date and time to filter results by creation time.
ToThe end date and time to filter results by creation time.
Updated FromThe start date and time to filter results by last updated time.
Updated ToThe end date and time to filter results by last updated time.

Example Output

{
	"data": {
		"getIncidents": {
			"incidents": [
				{
					"id": "<string>",
					"name": "<string>",
					"createdBy": "<string>",
					"createdAt": "2024-01-15T09:30:00Z",
					"lastUpdated": "2024-01-15T09:30:00Z",
					"severity": "LOW",
					"status": "NEW",
					"dataSources": [
						"<string>"
					],
					"verdict": "NA",
					"verdictReasoning": "<string>",
					"assignees": [
						{
							"userId": "<string>",
							"displayName": "<string>",
							"email": "<string>"
						}
					],
					"comments": [
						{
							"text": "<string>",
							"addedBy": "<string>",
							"addedAt": "2024-01-15T09:30:00Z"
						}
					],
					"incidentSummary": "<string>",
					"incidentFindings": [
						"<string>"
					],
					"assets": [
						"<string>"
					],
					"observables": [
						"<string>"
					],
					"alertsCount": 123,
					"alerts": [
						{
							"alertId": "<string>",
							"name": "<string>",
							"createdAt": "2024-01-15T09:30:00Z"
						}
					],
					"recommendedActions": [
						{
							"name": "<string>",
							"description": "<string>",
							"actionKey": "<string>",
							"targetParams": {}
						}
					],
					"investigationPlan": [
						{
							"stepName": "<string>",
							"stepConclusion": "<string>",
							"cells": [
								{
									"cellName": "<string>",
									"query": "<string>",
									"queryId": "<string>"
								}
							]
						}
					],
					"link": "<string>",
					"assignee": {
						"userId": "<string>",
						"displayName": "<string>",
						"email": "<string>"
					}
				}
			],
			"total": 123,
			"limit": 123,
			"offset": 123,
			"error": {
				"code": "<string>",
				"message": "<string>"
			}
		}
	}
}

Workflow Library Example

List Incidents with Vega and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop