getIncident

Get a single incident with its indicators.

Examples

GraphQL

query GetIncident($id: String!) {
  getIncident(id: $id) {
    id
    caseId
    name
    description
    type
    severity
    status
    blockedReason
    owner
    creator
    slaTargetAt
    settings {
      allowManualClosure
      autoCloseWhenResolved
      cleanDaysBeforeClose
      autoReopenOnNewHit
      watchWindowDays
    }
    isOxDeclared
    autoExpandFromSource
    externalReferences
    sourcePublishedAt
    counts {
      affectedApps
      affectedRepos
      affectedImages
      openFindings
      resolvedFindings
      sbomMatches
      pipelineHits
      clearedMatches
      blockedItems
      cloudAccounts
      cloudRunningImages
      cloudRunningThisVersionImages
      openFindingsBySeverity {
        appoxalypse
        critical
        high
        medium
        low
      }
    }
    exposureState
    currentSeverity
    isMonitoring
    affectedResourceCount
    summary {
      title
      bullets
      lines {
        segments {
          text
          emphasis
        }
      }
    }
    aiSummary {
      bullets
      generatedAt
      model
    }
    indicatorCounts {
      cve
      package
      packageRange
      image
      issue
      advisorySource
    }
    countsAsOf
    lastMatchedAt
    lastExposureChange
    resolvedAt
    createdAt
    updatedAt
    indicators {
      id
      incidentId
      kind
      value
      versionRange
      fixedVersions
      severity
      cvssScore
      addedAt
      source
      addedBy
      status
      url
      lastFetchedAt
      autoExpand
    }
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "id": "example"
}

cURL

Node.js

Python

Arguments

You can use the following argument(s) to customize your getIncident query.

Argument	Description	Supported fields
id String! required

Fields

Return type: Incident!

You can use the following field(s) to specify what information your getIncident query will return. Please note that some fields may have their own subfields.

Field	Description	Supported fields
id String!
caseId String!
name String!
description String
type IncidentType!
severity IncidentSeverity!
status IncidentStatus!
blockedReason String
owner String
creator String!
slaTargetAt DateTime
settings IncidentSettings!		allowManualClosure Boolean! autoCloseWhenResolved Boolean! cleanDaysBeforeClose Int! autoReopenOnNewHit Boolean! watchWindowDays Int!
isOxDeclared Boolean!
autoExpandFromSource Boolean!
externalReferences [String!]!
sourcePublishedAt DateTime
counts IncidentCounts!		affectedApps Int! affectedRepos Int! affectedImages Int! openFindings Int! resolvedFindings Int! sbomMatches Int! pipelineHits Int! clearedMatches Int! blockedItems Int! cloudAccounts Int! cloudRunningImages Int! cloudRunningThisVersionImages Int! openFindingsBySeverity IncidentSeverityCounts!
exposureState ExposureState
currentSeverity IncidentSeverity
isMonitoring Boolean!
affectedResourceCount Int!
summary [IncidentSummarySection!]!		title String! bullets [String!]! lines [IncidentSummaryLine!]!
aiSummary IncidentAiSummary		bullets [String!]! generatedAt DateTime model String
indicatorCounts IncidentIndicatorCounts		cve Int! package Int! packageRange Int! image Int! issue Int! advisorySource Int!
countsAsOf DateTime
lastMatchedAt DateTime
lastExposureChange DateTime
resolvedAt DateTime
createdAt DateTime
updatedAt DateTime
indicators [Indicator!]		id String! incidentId String! kind IndicatorKind! value String! versionRange String fixedVersions [String!]! severity IncidentSeverity cvssScore Float addedAt DateTime! source String! addedBy String status String! url String lastFetchedAt DateTime autoExpand Boolean