Incident search properties

You can use the following properties to create custom search queries within the Incidents module.

Incident search properties

Property	Format	Description
changed_status_at	Timestamp	The date/time the incident's status was last updated.
changed_status_by	String	The name of the operator who updated the incident's status.
changed_status_reason	String	The operator's comment that was provided when resolving or reopening an incident.
created_by	String	The name of the policy associated with the incident.
description	String	The incident's description.
detections	Integer	The number of detections forming the incident.
first_event	Timestamp	The date/time the incident's first detection was generated.
id	String	The incident's unique identifier.
last_event	Timestamp	The date/time the incident's last detection was generated.
last_updated	Timestamp	The date/time the incident's detection count was last updated.
score	Integer	The incident's risk score, derived from its detection(s)
started	Timestamp	The date/time the incident was created.
status	String	The incident status, such as open or resolved.
cluster_data.key	String	The cluster key used to form the incident.
cluster_data.key_value	String	The cluster key and value used to form the incident.
cluster_data.value	String	The cluster value used to form the incident.