Skip to main content

​
Basic Parameters​

ParameterDescription
From DateInclude incidents that were created after the given date. Represent in Unix epoch timestamp.
Incident StatusThe status of the incident.
Range Type-
To DateInclude incidents that were created before the given date. Represent in Unix epoch timestamp.

​
Advanced Parameters​

ParameterDescription
MaxThe maximum number of records to return.
OffsetThe offset of the item at which to begin the response.
SortSort the order of the result.

​
Example Output​

{    "status": "OK",    "messages": [        "Get incident details for incident ID [2293]"    ],    "result": {        "data": {            "totalIncidents": 1.0,            "incidentItems": [                {                    "violatorText": "TESTAUTOCASE2",                    "lastUpdateDate": 1683203728925,                    "violatorId": "TESTAUTOCASE2",                    "incidentType": "HighRiskRTActivityAccount",                    "incidentId": "2293",                    "incidentStatus": "Do Not Change",                    "riskscore": 0.0,                    "assignedGroup": "TestAutomation_Group",                    "priority": "Low",                    "reason": [                        "ResourceType: mvkApr10",                        "Policy: ActAcc4",                        "Threat: Abnormal DNS record type queries"                    ],                    "entity": "RTActivityAccount",                    "workflowName": "Test_INC",                    "url": "https://10.0.0.81:8479/Snypr/configurableDashboards/view?&type=incident&id=2293",                    "isWhitelisted": false,                    "watchlisted": false,                    "tenantInfo": {                        "tenantid": 1,                        "tenantname": "Optimus",                        "tenantcolor": "",                        "tenantshortcode": "OP"                    },                    "statusCompleted": false,                    "sandBoxPolicy": false,                    "parentCaseId": "",                    "casecreatetime": 1683187893436,                    "bulkactionallowed": true,                    "type": "HighRiskRTActivityAccount",                    "caseEventStartTime": 1681736367757,                    "solrquery": "index = violation  and @policyname=\"ActAcc4\" and @accountname=\"TESTAUTOCASE2\" and @tenantname=\"Optimus\" and generationtime between \"04/17/2023 07:59:27\" \"05/04/2023 17:33:04\"",                    "policystarttime": 1681736367757,                    "policyendtime": 1683239584337,                    "verboseinfo": "Account TESTAUTOCASE2 performed Logon failure 2 from ipaddress 111.93.188.91"                }            ]        }    }}

​
Workflow Library Example​

List Incidents with Securonix and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop