list_incidents
List incidents (triggered alerts) on the platform.
List incidents (triggered alerts) on the platform.
Read-only · Calls external systems. Safe to call: this tool does not modify data.
Parameters
| Field | Type | Required | Description |
|---|---|---|---|
alert_id | string | No | Comma-separated alert definition IDs |
closed_date_after | string | No | ISO datetime: only incidents closed after this time |
closed_date_before | string | No | ISO datetime: only incidents closed before this time |
created_after | string | No | ISO datetime: only incidents created after this time |
created_before | string | No | ISO datetime: only incidents created before this time |
detail | boolean | No | Return full JSON instead of compact summaries (default: false) |
operator | string | Yes | Operator slug |
page | number | No | Page number (default 1) |
status | string (OPEN | CLOSED | MANUALLY_CLOSED | CHANGED | DEACTIVATED) | No | Filter by status: OPEN, CLOSED, MANUALLY_CLOSED, CHANGED, DEACTIVATED |
Example arguments
Illustrative arguments an agent supplies when calling this tool:
{
"operator": "string"
}Description
Incidents are created when a platform alert definition fires. They track the lifecycle from OPEN to CLOSED.
NOT the same as evaluate_alert which performs local on-demand analytics. To manage platform alerts, use list_alert_definitions.
Filters: status (OPEN/CLOSED/MANUALLY_CLOSED/CHANGED/DEACTIVATED), alert_id (comma-sep), created_after/before, closed_date_after/before.Related
What's next?
Last updated on