Object properties for incidents

The following objects are included in the response for the incidents parameter.

Name	Supported	Description
id	INCIDENTS, DISCOVERY	Unique incident ID.
severity	INCIDENTS, DISCOVERY	Incident severity.
action	INCIDENTS, DISCOVERY	AUDITED, QUARANTINED, BLOCKED, ENCRYPTED, RELEASED, ESG_ACTION QUARANTINE_WITH_NOTE, UNSHARE_EXTERNAL, UNSHARE_ALL, UNSHARE_INTERNAL
tag	INCIDENTS	The incident tag. For example, my tag.
status	INCIDENTS	Incident status.
destination	INCIDENTS	Destination of the incident that was created. Email recipient if it is an email incident.
details	INCIDENTS	Summary/Subject title of email of incident if it is email channel, Web site if it is web channel.
released_incident	INCIDENTS	True/False field that identify if incident was released or not.
event_id	INCIDENTS, DISCOVERY	Unique event ID.
maximum_matches	INCIDENTS, DISCOVERY	Threshold number of total matches.
transaction_size	INCIDENTS, DISCOVERY (by ID only)	Size of the incident forensic.
assigned_to	INCIDENTS, DISCOVERY (by ID only)	The administrator name assigned to a ticket. For example: admin.
analyzed_by	INCIDENTS, DISCOVERY (by ID only)	Policy engine which analyzed and created the incident.
ignored_incidents	INCIDENTS	TRUE - means that the incident is not shown in UI report. FALSE - means that the incident is shown in UI report.
event_time	INCIDENTS	Time of event.
incident_time	INCIDENTS, DISCOVERY	Time of incident.
channel	INCIDENTS, DISCOVERY (by filter only)	Channel which created the incident.
policies	INCIDENTS, DISCOVERY	Which policy was triggered.
partition_index	INCIDENTS	Incidents table name. This parameter can be used to perform more effective update incident API requests.
detected_by	INCIDENTS	Which machine/protector detected the incident.
endpoint_type	INCIDENTS	LAPTOP, DESKTOP, NA
violation_triggers	INCIDENTS, DISCOVERY (by ID only)	Violation triggered objects. See Violation trigger object properties.
file_name	INCIDENTS	Network incident file name that triggered incident creation.
file_path	DISCOVERY	Discovery incident file path that triggered incident creation.
history	INCIDENTS, DISCOVERY (by ID only)	Historical trail of incident. See History array object properties.
sources	INCIDENTS, DISCOVERY (by ID only)	Transaction source (from where the transaction is originated).