Kaspersky Next XDR Expert
1.1.9
Threat detection  >  Working with incidents  >  Incident data model

Incident data model

The structure of an incident is represented by fields that contain values (see the table below). Some fields are objects or arrays of objects with their own set of fields (for example, the Assignee and Alerts fields).

Incident

Field

Value type

Is required

Description

InternalID

String

Yes

Internal incident ID, in the UUID format.

ID

Integer

Yes

Short internal incident ID.

TenantID

String

Yes

ID of the tenant that the incident is associated with, in the UUID format.

Name

String

Yes

Incident name.

Description

String

No

Incident description.

CreatedAt

String

Yes

Date and time of the incident creation, in the RFC 3339 format.

UpdatedAt

String

Yes

Date and time of the last incident change, in the RFC 3339 format.

StatusChangedAt

String

No

Date and time of the incident status change, in the RFC 3339 format.

Severity

String

No

Severity of the incident.

Possible values:

  • critical
  • high
  • medium
  • low

Priority

String

Yes

Priority of the incident.

Possible values:

  • critical
  • high
  • medium
  • low

Assignee

Assignee object

No

Operator to whom the incident is assigned.

FirstEventTime

String

No

Date and time of the first telemetry event of the alert related to the incident, in the RFC 3339 format.

LastEventTime

String

No

Date and time of the last telemetry event of the alert related to the incident, in the RFC 3339 format.

Status

String

Yes

Incident status.

Possible values:

  • open
  • inProgress
  • hold
  • closed

StatusResolution

String

No

Resolution of the incident status.

Possible values:

  • truePositive
  • falsePositive
  • lowPriority
  • merged

CreationType

String

Yes

Method of creating an incident.

Possible values:

  • auto
  • manual

Alerts

Array of Alert objects

No

Alerts included in the incident.

Assignee

Field

Value type

Is required

Description

ID

String

Yes

User account ID of the operator to whom the incident is assigned.

Name

String

Yes

Name of the operator to whom the incident is assigned.

Article ID: 269168, Last review: Dec 9, 2024
Page top