Response parameters

generalDetails

Top-level incident details

General incident details data object

incidentID

The ID assigned for an incident in Incident Manager.

string

occurred_UTC

The time when the incident occurred in UTC.

string

occurred_Endpoint

The time when the incident occurred at the endpoint.

string

incidentType

The type of incident.

string

actualAction

The action taken for the incident.

string

expectedAction

The expected action for the incident.

string

severity

The severity of the incident.

string

status

The status of the incident.

string

resolution

The current status of the incident.

string

reviewer

The reviewer assigned to the incident.

string

labels

The labels for the incident.

string

endpointDetails

Top-level of incident details from endpoints.

Endpoint incident details data object

computerName

The endpoint host name where the incident occurred.

string

computerIP

The IP address of the endpoint.

string

connectivityState

Shows whether the endpoint is online or offline.

string

sourceApplication

The application that caused the incident.

string

userDetails

userPrincipalName

The principal name of the user.

string

userAccount

The user account of the user.

string

userEmail

The email account of user.

string

userOU

The organizational unit of the user.

string

userGroups

The group of users.

reportingProduct

Top-level product level details.

Product data object

reportingProduct

The product that reported the incident.

string

productVersion

The version of the product.

string

policyName

The policy that triggered the incident.

string

totalMatchCount

The total matches for the incident queried.

string

totalContentSize_KB

The total size of the content.

string

additionalInformation

Top-level incident information. The details displayed vary according to the type of incident.

additional data object

Sender

The email address of the sender or the endpoint.

string

To

The email address of the recipient.

string

Cc

The email address of the recipient.

string

Bcc

The email address of the recipient.

string

SourceProxyIP

Proxy IP of the source

string

DestinationProxyIP

Proxy IP of the destination

string

EmailMessageId

Message ID of the email

string

EmailSubject

The subject of the email.

string

MatchRecipients

The list of recipients that matches the query.

string

AllRecipients

The list of all recipients who received the incident email.

string

customAttributes

Top-level custom attribute details.

Map of custom attributes (key-value pairs)

evidences

Top-level evidence details.

List of evidence items

evidenceName

The name of the evidence file.

string

itemType

The type of evidence.

string

fileSize_KB

The size of the evidence file.

string

matchCount

The number of matches for the incident query.

string

uniqueMatchCount

The number of unique matches.

string

shortMatchString

The short string used in the query.

string

uniqueMatchStrings

The number of unique match strings.

string

classifications

The classifications related to the incident.

string

path

The location of the evidence file.

string

sHA1

The signature of the evidence file.

string

rules

Top-level rules.

List of rules

ruleSetName

The name of the rule set.

string

ruleName

The name of the rule.

string

configuredAction

The action specified in the rule.

string

severity

The severity assigned to the incident.

string

modificationDate

The date on which the incident was modified.

string

classifications

The details of the classification.

List of classification matches

classificationName

The name of the classification.

string

matchCount

The number of matches.

string

uniqueMatchCount

The number of unique matches.

string

uniqueMatchStrings

The number of unique matches for strings.

string

stakeholders

The list of stakeholders for the incident.

List of stakeholders

auditLogs

Top-level audit log details.

List of audit log details

details

The details about the incident.

string

modifier

The name of the user who modified the details.

string

modificationDateUTC

The time on which the incident details were last modified.

string

comments

Top-level comment details.

List of comments

comment

The comment provided for the incident.

string

owner

The owner of the incident.

string

insertionDateUTC

The date on which the comment was added.

string

cases

List of cases

title

The title of the case.

string

status

The status of the case

string

resolution

The current process the case is going through.

string

owner

The owner of the case.

string

caseId

The ID of the case.

string