List incidents across workspaces
curl --request POST \
--url https://api.example.com/api/v2/incidents/across-workspaces \
--header 'Content-Type: application/json' \
--data '
{
"severities": [],
"statuses": [],
"timeFilterSelection": {
"customStartUtc": "2023-11-07T05:31:56Z",
"customEndUtc": "2023-11-07T05:31:56Z"
},
"filterByLastModified": true,
"workspacePageTokens": [
{
"workspaceId": "<string>",
"sourceTokens": {}
}
],
"query": "<string>",
"isFirstCall": true,
"sources": [],
"assigneeIds": [
"<string>"
],
"assigneeEmails": [
"<string>"
],
"includeUnassigned": true
}
'import requests
url = "https://api.example.com/api/v2/incidents/across-workspaces"
payload = {
"severities": [],
"statuses": [],
"timeFilterSelection": {
"customStartUtc": "2023-11-07T05:31:56Z",
"customEndUtc": "2023-11-07T05:31:56Z"
},
"filterByLastModified": True,
"workspacePageTokens": [
{
"workspaceId": "<string>",
"sourceTokens": {}
}
],
"query": "<string>",
"isFirstCall": True,
"sources": [],
"assigneeIds": ["<string>"],
"assigneeEmails": ["<string>"],
"includeUnassigned": True
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
severities: [],
statuses: [],
timeFilterSelection: {customStartUtc: '2023-11-07T05:31:56Z', customEndUtc: '2023-11-07T05:31:56Z'},
filterByLastModified: true,
workspacePageTokens: [{workspaceId: '<string>', sourceTokens: {}}],
query: '<string>',
isFirstCall: true,
sources: [],
assigneeIds: ['<string>'],
assigneeEmails: ['<string>'],
includeUnassigned: true
})
};
fetch('https://api.example.com/api/v2/incidents/across-workspaces', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v2/incidents/across-workspaces",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'severities' => [
],
'statuses' => [
],
'timeFilterSelection' => [
'customStartUtc' => '2023-11-07T05:31:56Z',
'customEndUtc' => '2023-11-07T05:31:56Z'
],
'filterByLastModified' => true,
'workspacePageTokens' => [
[
'workspaceId' => '<string>',
'sourceTokens' => [
]
]
],
'query' => '<string>',
'isFirstCall' => true,
'sources' => [
],
'assigneeIds' => [
'<string>'
],
'assigneeEmails' => [
'<string>'
],
'includeUnassigned' => true
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v2/incidents/across-workspaces"
payload := strings.NewReader("{\n \"severities\": [],\n \"statuses\": [],\n \"timeFilterSelection\": {\n \"customStartUtc\": \"2023-11-07T05:31:56Z\",\n \"customEndUtc\": \"2023-11-07T05:31:56Z\"\n },\n \"filterByLastModified\": true,\n \"workspacePageTokens\": [\n {\n \"workspaceId\": \"<string>\",\n \"sourceTokens\": {}\n }\n ],\n \"query\": \"<string>\",\n \"isFirstCall\": true,\n \"sources\": [],\n \"assigneeIds\": [\n \"<string>\"\n ],\n \"assigneeEmails\": [\n \"<string>\"\n ],\n \"includeUnassigned\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v2/incidents/across-workspaces")
.header("Content-Type", "application/json")
.body("{\n \"severities\": [],\n \"statuses\": [],\n \"timeFilterSelection\": {\n \"customStartUtc\": \"2023-11-07T05:31:56Z\",\n \"customEndUtc\": \"2023-11-07T05:31:56Z\"\n },\n \"filterByLastModified\": true,\n \"workspacePageTokens\": [\n {\n \"workspaceId\": \"<string>\",\n \"sourceTokens\": {}\n }\n ],\n \"query\": \"<string>\",\n \"isFirstCall\": true,\n \"sources\": [],\n \"assigneeIds\": [\n \"<string>\"\n ],\n \"assigneeEmails\": [\n \"<string>\"\n ],\n \"includeUnassigned\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v2/incidents/across-workspaces")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"severities\": [],\n \"statuses\": [],\n \"timeFilterSelection\": {\n \"customStartUtc\": \"2023-11-07T05:31:56Z\",\n \"customEndUtc\": \"2023-11-07T05:31:56Z\"\n },\n \"filterByLastModified\": true,\n \"workspacePageTokens\": [\n {\n \"workspaceId\": \"<string>\",\n \"sourceTokens\": {}\n }\n ],\n \"query\": \"<string>\",\n \"isFirstCall\": true,\n \"sources\": [],\n \"assigneeIds\": [\n \"<string>\"\n ],\n \"assigneeEmails\": [\n \"<string>\"\n ],\n \"includeUnassigned\": true\n}"
response = http.request(request)
puts response.read_body{
"data": {
"incidents": [
{
"id": "<string>",
"name": "<string>",
"displayId": "<string>",
"title": "<string>",
"description": "<string>",
"number": 123,
"type": "<string>",
"source": "Sentinel",
"sourceDisplayName": "<string>",
"lastModificationTime": "2023-11-07T05:31:56Z",
"creationTime": "2023-11-07T05:31:56Z",
"lastActivityTime": "2023-11-07T05:31:56Z",
"severity": "Informational",
"classification": "BenignPositive",
"comment": "<string>",
"classificationReason": "InaccurateData",
"classificationComment": "<string>",
"tactics": [
"<string>"
],
"ruleIds": [
"<string>"
],
"providerName": "<string>",
"isForwardedMirror": true,
"vendorIdentifiers": {
"sentinel": {
"armId": "<string>",
"incidentId": "<string>",
"subscriptionId": "<string>",
"resourceGroupName": "<string>",
"workspaceName": "<string>",
"incidentNumber": 123,
"portalUrl": "<string>"
},
"defender": {
"incidentId": "<string>",
"tenantId": "<string>",
"portalUrl": "<string>"
}
},
"alertProductNames": [
"<string>"
],
"user": {
"id": "<string>",
"displayName": "<string>",
"email": "<string>"
},
"isAssigned": true,
"productId": "<string>",
"status": "Active",
"closedUpstreamDuringPause": true,
"alertsCount": 123,
"entities": [
{
"id": "<string>",
"type": "User",
"kind": "<string>",
"displayName": "<string>",
"friendlyName": "<string>",
"fileName": "<string>",
"hostName": "<string>",
"accountEntityId": "<string>",
"deviceId": "<string>",
"deviceAzureId": "<string>",
"defenderAtpDeviceId": "<string>",
"defenderEndpointDeviceId": "<string>",
"networkMessageId": "<string>",
"hashAlgorithm": "<string>",
"aadUserId": "<string>",
"emailAddress": "<string>",
"userPrincipalName": "<string>",
"ipAddress": "<string>",
"fileHash": "<string>",
"emailId": "<string>",
"emailSubject": "<string>"
}
],
"workspaceName": "<string>",
"workspaceId": "<string>",
"isDefenderXDRSourced": true
}
],
"sourcePageTokens": [
{
"workspaceId": "<string>",
"sourceTokens": {}
}
],
"moreIncidentsAvailable": true
},
"meta": {
"requestId": "<string>",
"timestamp": "<string>"
}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}Cross-workspace incidents
List incidents across workspaces
POST
/
api
/
v2
/
incidents
/
across-workspaces
List incidents across workspaces
curl --request POST \
--url https://api.example.com/api/v2/incidents/across-workspaces \
--header 'Content-Type: application/json' \
--data '
{
"severities": [],
"statuses": [],
"timeFilterSelection": {
"customStartUtc": "2023-11-07T05:31:56Z",
"customEndUtc": "2023-11-07T05:31:56Z"
},
"filterByLastModified": true,
"workspacePageTokens": [
{
"workspaceId": "<string>",
"sourceTokens": {}
}
],
"query": "<string>",
"isFirstCall": true,
"sources": [],
"assigneeIds": [
"<string>"
],
"assigneeEmails": [
"<string>"
],
"includeUnassigned": true
}
'import requests
url = "https://api.example.com/api/v2/incidents/across-workspaces"
payload = {
"severities": [],
"statuses": [],
"timeFilterSelection": {
"customStartUtc": "2023-11-07T05:31:56Z",
"customEndUtc": "2023-11-07T05:31:56Z"
},
"filterByLastModified": True,
"workspacePageTokens": [
{
"workspaceId": "<string>",
"sourceTokens": {}
}
],
"query": "<string>",
"isFirstCall": True,
"sources": [],
"assigneeIds": ["<string>"],
"assigneeEmails": ["<string>"],
"includeUnassigned": True
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
severities: [],
statuses: [],
timeFilterSelection: {customStartUtc: '2023-11-07T05:31:56Z', customEndUtc: '2023-11-07T05:31:56Z'},
filterByLastModified: true,
workspacePageTokens: [{workspaceId: '<string>', sourceTokens: {}}],
query: '<string>',
isFirstCall: true,
sources: [],
assigneeIds: ['<string>'],
assigneeEmails: ['<string>'],
includeUnassigned: true
})
};
fetch('https://api.example.com/api/v2/incidents/across-workspaces', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v2/incidents/across-workspaces",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'severities' => [
],
'statuses' => [
],
'timeFilterSelection' => [
'customStartUtc' => '2023-11-07T05:31:56Z',
'customEndUtc' => '2023-11-07T05:31:56Z'
],
'filterByLastModified' => true,
'workspacePageTokens' => [
[
'workspaceId' => '<string>',
'sourceTokens' => [
]
]
],
'query' => '<string>',
'isFirstCall' => true,
'sources' => [
],
'assigneeIds' => [
'<string>'
],
'assigneeEmails' => [
'<string>'
],
'includeUnassigned' => true
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v2/incidents/across-workspaces"
payload := strings.NewReader("{\n \"severities\": [],\n \"statuses\": [],\n \"timeFilterSelection\": {\n \"customStartUtc\": \"2023-11-07T05:31:56Z\",\n \"customEndUtc\": \"2023-11-07T05:31:56Z\"\n },\n \"filterByLastModified\": true,\n \"workspacePageTokens\": [\n {\n \"workspaceId\": \"<string>\",\n \"sourceTokens\": {}\n }\n ],\n \"query\": \"<string>\",\n \"isFirstCall\": true,\n \"sources\": [],\n \"assigneeIds\": [\n \"<string>\"\n ],\n \"assigneeEmails\": [\n \"<string>\"\n ],\n \"includeUnassigned\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v2/incidents/across-workspaces")
.header("Content-Type", "application/json")
.body("{\n \"severities\": [],\n \"statuses\": [],\n \"timeFilterSelection\": {\n \"customStartUtc\": \"2023-11-07T05:31:56Z\",\n \"customEndUtc\": \"2023-11-07T05:31:56Z\"\n },\n \"filterByLastModified\": true,\n \"workspacePageTokens\": [\n {\n \"workspaceId\": \"<string>\",\n \"sourceTokens\": {}\n }\n ],\n \"query\": \"<string>\",\n \"isFirstCall\": true,\n \"sources\": [],\n \"assigneeIds\": [\n \"<string>\"\n ],\n \"assigneeEmails\": [\n \"<string>\"\n ],\n \"includeUnassigned\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v2/incidents/across-workspaces")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"severities\": [],\n \"statuses\": [],\n \"timeFilterSelection\": {\n \"customStartUtc\": \"2023-11-07T05:31:56Z\",\n \"customEndUtc\": \"2023-11-07T05:31:56Z\"\n },\n \"filterByLastModified\": true,\n \"workspacePageTokens\": [\n {\n \"workspaceId\": \"<string>\",\n \"sourceTokens\": {}\n }\n ],\n \"query\": \"<string>\",\n \"isFirstCall\": true,\n \"sources\": [],\n \"assigneeIds\": [\n \"<string>\"\n ],\n \"assigneeEmails\": [\n \"<string>\"\n ],\n \"includeUnassigned\": true\n}"
response = http.request(request)
puts response.read_body{
"data": {
"incidents": [
{
"id": "<string>",
"name": "<string>",
"displayId": "<string>",
"title": "<string>",
"description": "<string>",
"number": 123,
"type": "<string>",
"source": "Sentinel",
"sourceDisplayName": "<string>",
"lastModificationTime": "2023-11-07T05:31:56Z",
"creationTime": "2023-11-07T05:31:56Z",
"lastActivityTime": "2023-11-07T05:31:56Z",
"severity": "Informational",
"classification": "BenignPositive",
"comment": "<string>",
"classificationReason": "InaccurateData",
"classificationComment": "<string>",
"tactics": [
"<string>"
],
"ruleIds": [
"<string>"
],
"providerName": "<string>",
"isForwardedMirror": true,
"vendorIdentifiers": {
"sentinel": {
"armId": "<string>",
"incidentId": "<string>",
"subscriptionId": "<string>",
"resourceGroupName": "<string>",
"workspaceName": "<string>",
"incidentNumber": 123,
"portalUrl": "<string>"
},
"defender": {
"incidentId": "<string>",
"tenantId": "<string>",
"portalUrl": "<string>"
}
},
"alertProductNames": [
"<string>"
],
"user": {
"id": "<string>",
"displayName": "<string>",
"email": "<string>"
},
"isAssigned": true,
"productId": "<string>",
"status": "Active",
"closedUpstreamDuringPause": true,
"alertsCount": 123,
"entities": [
{
"id": "<string>",
"type": "User",
"kind": "<string>",
"displayName": "<string>",
"friendlyName": "<string>",
"fileName": "<string>",
"hostName": "<string>",
"accountEntityId": "<string>",
"deviceId": "<string>",
"deviceAzureId": "<string>",
"defenderAtpDeviceId": "<string>",
"defenderEndpointDeviceId": "<string>",
"networkMessageId": "<string>",
"hashAlgorithm": "<string>",
"aadUserId": "<string>",
"emailAddress": "<string>",
"userPrincipalName": "<string>",
"ipAddress": "<string>",
"fileHash": "<string>",
"emailId": "<string>",
"emailSubject": "<string>"
}
],
"workspaceName": "<string>",
"workspaceId": "<string>",
"isDefenderXDRSourced": true
}
],
"sourcePageTokens": [
{
"workspaceId": "<string>",
"sourceTokens": {}
}
],
"moreIncidentsAvailable": true
},
"meta": {
"requestId": "<string>",
"timestamp": "<string>"
}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}Body
application/json
v2 request for listing incidents across multiple workspaces.
Filter incidents to only the listed severities. Empty list returns all severities.
Available options:
Informational, Low, Medium, High Filter incidents to only the listed statuses. Empty list returns all statuses.
Available options:
Active, New, Closed, OnHold, WaitingOnCustomer Time window applied to the incident's creation time, or to its last-modified time when filterByLastModified is true. Defaults to the last 24 hours.
Show child attributes
Show child attributes
When true, timeFilterSelection bounds the incident's last-modified time instead of its creation time, and each page is ordered by last-modified time descending. Use this to synchronise updates into an external system: poll a short window that ends at the time of the call and receive every incident whose Microsoft Sentinel or Microsoft Defender XDR record changed in that window (alert grouped in, severity, status, owner, label, comment), including incidents created long before the window. An incident created inside the window but modified after its end is not in this window; it appears in the next one. In this mode each workspace's window is returned in full in one call unless it exceeds the server's page cap; if moreIncidentsAvailable is true, narrow the window rather than paging, because vendor continuations are positional and a concurrent edit can shift them. The timestamp is the vendor's (lastModifiedTimeUtc / lastUpdateDateTime), not lastActivityTime. Supported for Sentinel and DefenderXDR only: an empty sources list selects those two, and listing any other source together with this flag returns 400.
Opaque pagination tokens echoed from the previous response's SourcePageTokens.
Leave empty on the first call. See type-level remarks for the pagination protocol.
Show child attributes
Show child attributes
Free-text search applied across incident title/description fields. Empty matches all.
true for the initial request; false when echoing
List<WorkspaceSourcePageTokens> ListIncidentsAcrossWorkspacesRequest.WorkspacePageTokens back for subsequent pages. See type-level
remarks for the pagination protocol.
Filter incidents to only the listed sources (e.g. Sentinel, DefenderXDR, CrowdStrike). Empty list returns all sources the caller has access to.
Available options:
Sentinel, DefenderXDR, QRadar, Splunk, CrowdStrike, SentinelOne Filter incidents assigned to any of the listed ContraForce user IDs.
Filter incidents assigned to any of the listed user email addresses.
When true, include incidents that have no assignee alongside any
matches from List<string> ListIncidentsAcrossWorkspacesRequest.AssigneeIds / List<string> ListIncidentsAcrossWorkspacesRequest.AssigneeEmails.