HUhuntress
Reseller

List Incident Reports

Changed on

Shows Incident Reports associated with your account.

get/v1/accounts/{account_id}/incident_reports

Request

  • Base URL
    https://api.huntress.io
  • URL
    https://api.huntress.io/v1/accounts/{account_id}/incident_reports
  • Auth
    basic (a scheme the document does not define)

Path parameters

account_idinteger required

Query parameters

limitinteger

Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.

page_tokenstring

Token used to request the next page in paginated results. Defaults to 'null'

sort_field'id' | 'created_at' | 'updated_at'

Field to sort by. Defaults to 'id'.

sort_direction'asc' | 'desc'

Sort direction. Defaults to 'desc'.

indicator_type'footholds' | 'monitored_files' | 'ransomware_canaries' | 'antivirus_detections' | 'process_detections' | 'managed_identity' | 'mde_detections' | 'siem_detections' | 'favicon_detections' | 'behavioral_detections' | 'email_security_detections' | 'app_control' | 'ai_misuse'

Filter by indicator type. One of footholds, monitored_files, ransomware_canaries, antivirus_detections, process_detections, managed_identity, mde_detections, siem_detections, favicon_detections, behavioral_detections, email_security_detections, app_control, ai_misuse

status'sent' | 'closed' | 'dismissed' | 'auto_remediating' | 'deleting' | 'partner_dismissed'

Filter by status. One of sent, closed, dismissed, auto_remediating, deleting, partner_dismissed

severity'low' | 'high' | 'critical'

Filter by severity. One of low, high, critical

platform'windows' | 'darwin' | 'microsoft_365' | 'google' | 'linux' | 'email_security' | 'other'

Filter by platform. One of windows, darwin, microsoft_365, google, linux, email_security, other

organization_idinteger

Filter by organization ID within Huntress account

agent_idinteger

Filter by agent ID within Huntress account

psa_ticket_eidstring

Filter by the external identifier (EID) of a ticket Huntress opened in your PSA — the identifier your PSA assigned to the ticket. Depending on the PSA, this may differ from the ticket number a technician sees.

Matches the Incident Report the ticket was opened for. Tickets Huntress opened for anything other than an Incident Report, such as an escalation, will not match.

Response

List Incident Reports

Example response

{
  "incident_reports": [
    {
      "id": 1,
      "account_id": 5,
      "agent_id": 12,
      "body": "<Content>",
      "closed_at": "2022-03-15T14:22:00Z",
      "indicator_counts": {
        "footholds": 1,
        "monitored_files": 0,
        "process_detections": 0,
        "ransomware_canaries": 0,
        "antivirus_detections": 0
      },
      "indicator_types": [
        "footholds"
      ],
      "organization_id": 4,
      "platform": "windows",
      "psa_ticket_eids": [
        "T-1696"
      ],
      "remediations": {
        "total_count": 1,
        "has_more": false,
        "items": [
          {
            "id": 1,
            "type": "manual",
            "action": "Delete File",
            "parameters": [
              {
                "name": "path",
                "description": "c:\\windows\\system32\\tasks\\malicious_task"
              }
            ],
            "status": "completed",
            "approved_at": "2025-06-26T18:57:03Z",
            "approved_by": {
              "id": "123123",
              "email": "john.smith@example.com",
              "name": "John smith"
            },
            "completed_at": "2025-06-26T18:57:03Z"
          }
        ]
      },
      "sent_at": "2022-03-01T21:00:00Z",
      "severity": "low",
      "status": "closed",
      "status_updated_at": "2022-03-15T14:22:00Z",
      "subject": "LOW - Incident on laptop01 (Test)",
      "summary": "Huntress detected a malicious scheduled task on this host. We recommend removing the file and scheduled task listed in the remediation steps below.",
      "updated_at": "2022-03-01T20:31:30Z"
    }
  ]
}

Changes