Object properties for incidents

The following objects are included in the response for the incidents parameter.

Name Supported Description
id INCIDENTS, DISCOVERY Unique incident ID.
severity INCIDENTS, DISCOVERY Incident severity.
action INCIDENTS, DISCOVERY

AUDITED, QUARANTINED, BLOCKED, ENCRYPTED, RELEASED, ESG_ACTION

QUARANTINE_WITH_NOTE, UNSHARE_EXTERNAL, UNSHARE_ALL, UNSHARE_INTERNAL

tag INCIDENTS The incident tag. For example, my tag.
status INCIDENTS Incident status.
destination INCIDENTS Destination of the incident that was created. Email recipient if it is an email incident.
details INCIDENTS Summary/Subject title of email of incident if it is email channel, Web site if it is web channel.
released_incident INCIDENTS True/False field that identify if incident was released or not.
event_id INCIDENTS, DISCOVERY Unique event ID.
maximum_matches INCIDENTS, DISCOVERY Threshold number of total matches.
transaction_size

INCIDENTS,DISCOVERY

(by ID only)

Size of the incident forensic.
assigned_to

INCIDENTS,DISCOVERY

(by ID only)

The administrator name assigned to a ticket. For example: admin.
analyzed_by

INCIDENTS,DISCOVERY

(by ID only)

Policy engine which analyzed and created the incident.
ignored_incidents INCIDENTS

TRUE - means that the incident is not shown in UI report.

FALSE - means that the incident is shown in UI report.

event_time INCIDENTS Time of event.
incident_time INCIDENTS, DISCOVERY Time of incident.
channel

INCIDENTS,DISCOVERY

(by filter only)

Channel which created the incident.
policies INCIDENTS, DISCOVERY Which policy was triggered.
partition_index INCIDENTS Incidents table name. This parameter can be used to perform more effective update incident API requests.
detected_by INCIDENTS Which machine/protector detected the incident.
endpoint_type INCIDENTS LAPTOP, DESKTOP, NA
violation_triggers

INCIDENTS,DISCOVERY

(by ID only)

Violation triggered objects. See Violation trigger object properties.
file_name INCIDENTS Network incident file name that triggered incident creation.
file_path DISCOVERY Discovery incident file path that triggered incident creation.
history

INCIDENTS,DISCOVERY

(by ID only)

Historical trail of incident. See History array object properties.
sources

INCIDENTS,DISCOVERY

(by ID only)

Transaction source (from where the transaction is originated).