WAwatchguard
Get Incident

Retrieves a specific incident.

Retrieves a specific incident by incident ID.

get/v1/{accountId}/incidents/{incidentId}

Request

Path parameters

accountIdstring required

Your WatchGuard Cloud Account ID.

incidentIdstring required

ID of an incident.

Query parameters

includeActionsboolean

Specifies whether to include actions for an incident.

includeCommentsboolean

Specifies whether to include comments for an incident.

Response

Successful response.

idstring

ID of the incident.

accountstring

Account ID.

categorystring

Category of the incident.

typestring

Specific type of incident within an incident category.

timestampstring

Date and time the incident was created.

threatScoreinteger

Threat score of incident.

severitystring

The severity of the incident. Possible values are Low, Medium, High, and Critical.

descriptionstring

A description of the incident.

remediatedboolean

Remediation status of the incident.

entityIdsstring[]
statusstring

Specifies the status of the incident. This can be one of these values:

  • new - New incidents not yet reviewed.
  • read - Reviewed incidents or incidents marked as read.
  • closed - Incidents closed by an automation policy or manually closed.
lastUpdateTimestring

The date and time (in UTC) when the incident status was last changed.

updatedBystring

The name of the operator that updated the incident status. Or "system" if the update was in response to an automated action.

Example response

{
  "id": "cg0f0s2h7skomt847f1g",
  "account": "WCG-1-123abc456 or ACC-1234567",
  "category": "malware",
  "type": "Panda.SpywareB.TestFile",
  "timestamp": "2023-03-02T18:52:20Z",
  "threatScore": 5,
  "severity": "Medium",
  "entities": {
    "8ed6cbce746d4597A6469bbc0c4edce9": {
      "type": "endpoint",
      "recommendedActions": [
        {
          "command": "isolate"
        },
        {
          "command": "quarantineFile",
          "parameters": {
            "md5": "E76A3640348DC959CB4D87C81F27A1A1"
          }
        }
      ],
      "actionPerformed": {
        "command": "deleteFile",
        "parameters": {
          "md5": "E76A3640348DC959CB4D87C81F27A1A1"
        }
      },
      "threatDetails": {
        "malware": "Panda.SpywareB.TestFile",
        "file": "DESKTOPDIRECTORY|\\\\WESS tools\\\\malware\\\\Spy.EXE",
        "md5": "E76A3640348DC959CB4D87C81F27A1A1"
      }
    }
  },
  "entityIds": [
    "8ed6cbce-746d-4597-a646-9bbc0c4edce9"
  ],
  "status": "closed",
  "lastUpdateTime": "2023-09-27T06:21:43Z",
  "updatedBy": "ffc1c30697abdc4e_rw_id"
}

Changes

No recorded changes to this operation across all 1 revision of this API.