Sign in
latestSwagger 2.02026-08-109450223.9 KB

94acb422c07d

Incident Reports

List Incident Reports

Shows Incident Reports associated with your account.

Note: This endpoint will also return a pagination key on the root level.
Please refer to the pagination section within our docs for more information.

get/v1/incident_reports

Query parameters

limitinteger

Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.

page_tokenstring

Token used to request the next page in paginated results. Defaults to 'null'

sort_field'id' | 'created_at' | 'updated_at'

Field to sort by. Defaults to 'id'.

sort_direction'asc' | 'desc'

Sort direction. Defaults to 'desc'.

indicator_type'footholds' | 'monitored_files' | 'ransomware_canaries' | 'antivirus_detections' | 'process_detections' | 'managed_identity' | 'mde_detections' | 'siem_detections' | 'favicon_detections' | 'behavioral_detections' | 'email_security_detections' | 'app_control' | 'ai_misuse'

Filter by indicator type. One of footholds, monitored_files, ransomware_canaries, antivirus_detections, process_detections, managed_identity, mde_detections, siem_detections, favicon_detections, behavioral_detections, email_security_detections, app_control, ai_misuse

status'sent' | 'closed' | 'dismissed' | 'auto_remediating' | 'deleting' | 'partner_dismissed'

Filter by status. One of sent, closed, dismissed, auto_remediating, deleting, partner_dismissed

severity'low' | 'high' | 'critical'

Filter by severity. One of low, high, critical

platform'windows' | 'darwin' | 'microsoft_365' | 'google' | 'linux' | 'email_security' | 'other'

Filter by platform. One of windows, darwin, microsoft_365, google, linux, email_security, other

organization_idinteger

Filter by organization ID within Huntress account

agent_idinteger

Filter by agent ID within Huntress account

Response

List Incident Reports

Example response

{
  "incident_reports": [
    {
      "id": 1,
      "account_id": 5,
      "agent_id": 12,
      "body": "<Content>",
      "closed_at": "2022-03-15T14:22:00Z",
      "indicator_counts": {
        "footholds": 1,
        "monitored_files": 0,
        "process_detections": 0,
        "ransomware_canaries": 0,
        "antivirus_detections": 0
      },
      "indicator_types": [
        "footholds"
      ],
      "organization_id": 4,
      "platform": "windows",
      "remediations": {
        "total_count": 1,
        "has_more": false,
        "items": [
          {
            "id": 1,
            "type": "manual",
            "action": "Delete File",
            "parameters": [
              {
                "name": "path",
                "description": "c:\\windows\\system32\\tasks\\malicious_task"
              }
            ],
            "status": "completed",
            "approved_at": "2025-06-26T18:57:03Z",
            "approved_by": {
              "id": "123123",
              "email": "john.smith@example.com",
              "name": "John smith"
            },
            "completed_at": "2025-06-26T18:57:03Z"
          }
        ]
      },
      "sent_at": "2022-03-01T21:00:00Z",
      "severity": "low",
      "status": "closed",
      "status_updated_at": "2022-03-15T14:22:00Z",
      "subject": "LOW - Incident on laptop01 (Test)",
      "summary": "Huntress detected a malicious scheduled task on this host. We recommend removing the file and scheduled task listed in the remediation steps below.",
      "updated_at": "2022-03-01T20:31:30Z"
    }
  ]
}