Actions75
- EndpointAutopilot Actions
- TenantAdministrationAlerts Actions
- EndpointMEM Actions
- TenantGDAP Actions
- TenantAdministrationApplicationApproval Actions
- TenantAdministration Actions
- CIPPSetup Actions
- Security Actions
- IdentityAdministrationDevices Actions
- CIPPExtensions Actions
- EmailExchangeTools Actions
Security → ExecIncidentsList
AI-generatedOverview
This node interacts with the CIPP API to retrieve a list of security incidents for a specified tenant. It supports fetching all incidents or a single page of results, with options for custom request body, headers, query filters, batching, debugging, and pagination. This is useful for security teams or IT administrators who need to monitor and analyze security incidents across tenants in a multi-tenant environment.
Use Case Examples
- Fetch all security incidents for a specific tenant to monitor potential threats.
- Retrieve a single page of security incidents for quick review or integration with other security tools.
Properties
| Name | Meaning |
|---|---|
| Return All | Whether to return all results or only a single page. When disabled, no pagination parameters are sent and only one page of results is returned. |
| Tenant Filter | Target tenant domain or 'AllTenants' for multi-tenant operations. |
| Options | Additional optional settings such as custom request body, headers, query filters, batching, debug mode, pagination settings, and request timeout. |
Output
JSON
json- The JSON response containing the list of security incidents and related data.
Dependencies
- An API key credential for authenticating with the CIPP API
Troubleshooting
- Ensure the tenant filter is correctly specified and the API key credential is valid and has necessary permissions.
- If pagination is enabled, verify pagination parameters are correctly configured to avoid incomplete data.
- Enable debug mode to see the actual request URL, headers, query parameters, and body for troubleshooting.