---
title: "Incident Report"
method: POST
path: "/identity/incident/report"
tags: ["Credentials"]
---

# Incident Report

`POST /identity/incident/report`

Get a detailed exposure incident report for a single malware log, including compromised credentials, device details, and malware attribution.

## Request body

- IncidentReportRequest
  - `organization_id` string
  - `source` string, required — The dump source identifier (e.g., dump-redline-2024-07-21-001)
  - `include_details` boolean, required — Include extended device and malware details in the response
  - `limit` integer — Maximum number of credential entries to return
  - `offset` string — Pagination token for next page

## Response `200`

Success

- IncidentReportResponse
  - `count` integer, required
  - `total_count` integer, required
  - `credentials` IncidentReportCredentials[], required
    - `authorization_domain` string
    - `email_or_login` string, required
    - `password` string, required
    - `password_sha1` string
    - `domain_category` string
    - `domain_technology` string
    - `contains_cookies` boolean, required
    - `contains_active_cookies` boolean, required
    - `contains_high_risk_technologies` boolean, required
  - `details` IncidentReportDetails
    - `malware_family` string
    - `os` string
    - `os_username` string
    - `malware_file` string
    - `timezone` string
    - `uac` string
    - `exfiltration_date` string, date-time
    - `antivirus` string
    - `ip_address` string
    - `postal_code` string
    - `country` string
  - `next_offset` string

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error
- `default` — Error

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)