incidentsConnection

Examples

type IncidentsConnection {
  items: [Incident!]!
  totalCount: Int!
  totalUnfilteredCount: Int!
  hasMore: Boolean!
}

Fields

Field	Description	Supported fields
items [Incident!]!		id String! caseId String! name String! description String type IncidentType! severity IncidentSeverity! status IncidentStatus! classification IncidentClassification scope IncidentScope exploitationStatus CveExploitationStatus exploitationSource CveExploitationSource blockedReason String owner String creator String! slaTargetAt DateTime settings IncidentSettings! isOxDeclared Boolean! publishType IncidentPublishType! publishTypeReason String autoExpandFromSource Boolean! externalReferences [String!]! sourcePublishedAt DateTime ⚠️ sourceCreatedAt DateTime kevDiscoveredAt DateTime pinPosture IncidentPinPosture oxPublishedAt DateTime counts IncidentCounts! exposureState ExposureState currentSeverity IncidentSeverity isMonitoring Boolean! affectedResourceCount Int! summary [IncidentSummarySection!]! aiSummary IncidentAiSummary indicatorCounts IncidentIndicatorCounts lastRunDelta IncidentLastRunDelta countsAsOf DateTime lastMatchedAt DateTime lastExposureChange DateTime assessmentComplete Boolean incompleteSources [String!] resolvedAt DateTime createdAt DateTime updatedAt DateTime indicators [Indicator!]
totalCount Int!
totalUnfilteredCount Int!	Counts the incidents in the organization that the incident list can show, ignoring the search and filters of the request.
hasMore Boolean!

References

Queries using this object:

• <?> getIncidents