Acronis · Schema

IncidentBrief

Incident information.

CybersecurityData ProtectionEndpoint ManagementBackup and RecoveryDisaster RecoveryManaged Service ProvidersEndpoint Detection and ResponseCloud Storage

Properties

Name Type Description
incident_time string Deprecated - use created_at.
transferred_to_incident_id string An ID of the incident in case of this incident was transferred into another incident, potentially multi-workload.
workloads array List of associated workloads information for multi-workload incidents. "workloads" array is present only if incident involves multiple workloads, in that case WorkloadInfo fields at the root level are
state string Current state of the investigation in the EDR system.
ticket_subject string External ticket subject.
verdict string Is the incident considered malicious activity.
created_at string UTC timestamp of the incident creation.
host_name string Hostname of the source endpoint of the incident.
mdr_state object Last updated state of the investigation received from an MDR system, may include MDR specific states.
updated_at string UTC timestamp of the last incident update.
assignee string Name of an external agent assigned to the ticket.
assignee_id string User ID of agent assigned to the ticket. Must contain an UUID of a registered user with access rights to the incident.
resource_id string Unique identifier of the endpoint associated with this event, referencing the corresponding records in the event search system.
positivity number Positivity score of the incident.
ticket_id string External ticket ID associated with the incident.
incident_id string ID of the incident object.
agent_version string Version of the running agent.
incident_short_id integer Short ID of the incident object in the context of a customer.
incident_link string Link to the incident investigation page.
mitigation_state object
severity string Severity level of the incident.
incident_categories array Incident categories.
customer_id string ID of the customer.
host_domain string Domain or workgroup the host is part of.
priority string Priority assigned to the ticket.
host_address string IP (v4/v6) address assigned to the communicating network interface.
View JSON Schema on GitHub

JSON Schema

acronis-incident-brief-schema.json Raw ↑ 
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/acronis/main/json-schema/acronis-incident-brief-schema.json",
  "title": "IncidentBrief",
  "description": "Incident information.",
  "x-generated": "2026-10-27",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/acronis-incidents-api-openapi.yml#/components/schemas/IncidentBrief",
  "type": "object",
  "required": [
    "incident_time",
    "state",
    "verdict",
    "created_at",
    "updated_at",
    "positivity",
    "incident_id",
    "mitigation_state",
    "severity"
  ],
  "properties": {
    "incident_time": {
      "description": "Deprecated - use created_at.",
      "type": "string",
      "format": "date-time"
    },
    "transferred_to_incident_id": {
      "description": "An ID of the incident in case of this incident was transferred into another incident,\npotentially multi-workload.\n",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "workloads": {
      "description": "List of associated workloads information for multi-workload incidents.\n\"workloads\" array is present only if incident involves multiple workloads,\nin that case WorkloadInfo fields at the root level are omitted.\n",
      "type": "array",
      "minItems": 2,
      "items": {
        "$ref": "#/$defs/WorkloadInfo"
      }
    },
    "state": {
      "description": "Current state of the investigation in the EDR system.\n",
      "enum": [
        "NOT_STARTED",
        "INVESTIGATING",
        "TRIAGED",
        "FALSE_POSITIVE",
        "CLOSED"
      ],
      "type": "string"
    },
    "ticket_subject": {
      "description": "External ticket subject.",
      "type": "string"
    },
    "verdict": {
      "description": "Is the incident considered malicious activity.",
      "enum": [
        "SUSPICIOUS",
        "MALICIOUS"
      ],
      "type": "string"
    },
    "created_at": {
      "description": "UTC timestamp of the incident creation.",
      "type": "string",
      "format": "date-time"
    },
    "host_name": {
      "description": "Hostname of the source endpoint of the incident.",
      "type": "string"
    },
    "mdr_state": {
      "description": "Last updated state of the investigation received from an MDR system, may include MDR specific states.\n",
      "anyOf": [
        {
          "$ref": "#/$defs/InvestigationState"
        },
        {
          "type": "string"
        }
      ]
    },
    "updated_at": {
      "description": "UTC timestamp of the last incident update.",
      "type": "string",
      "format": "date-time"
    },
    "assignee": {
      "description": "Name of an external agent assigned to the ticket.",
      "type": "string"
    },
    "assignee_id": {
      "description": "User ID of agent assigned to the ticket.\nMust contain an UUID of a registered user with access rights to the incident.\n",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "resource_id": {
      "description": "Unique identifier of the endpoint associated with this event, referencing the corresponding records in the event search system.",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "positivity": {
      "description": "Positivity score of the incident.",
      "type": "number",
      "format": "float",
      "minimum": 0,
      "maximum": 10
    },
    "ticket_id": {
      "description": "External ticket ID associated with the incident.",
      "type": "string"
    },
    "incident_id": {
      "description": "ID of the incident object.",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "agent_version": {
      "description": "Version of the running agent.",
      "type": "string"
    },
    "incident_short_id": {
      "description": "Short ID of the incident object in the context of a customer.",
      "type": "integer",
      "format": "int32",
      "minimum": 1
    },
    "incident_link": {
      "description": "Link to the incident investigation page.",
      "type": "string"
    },
    "mitigation_state": {
      "$ref": "#/$defs/MitigationState"
    },
    "severity": {
      "description": "Severity level of the incident.",
      "enum": [
        "LOW",
        "MEDIUM",
        "HIGH",
        "CRITICAL"
      ],
      "type": "string"
    },
    "incident_categories": {
      "description": "Incident categories.",
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {
        "description": "Incident threat category.",
        "enum": [
          "MALWARE_DETECTED",
          "PROCESS_DETECTED",
          "MBR_ACTIVITY_BLOCKED",
          "URL_BLOCKED",
          "WEBSITE_URL_BLOCKED",
          "MS_DEFENDER",
          "THIRD_PARTY_OTHER",
          "UNKNOWN_CATEGORY"
        ],
        "type": "string"
      }
    },
    "customer_id": {
      "description": "ID of the customer.",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "host_domain": {
      "description": "Domain or workgroup the host is part of.",
      "type": "string"
    },
    "priority": {
      "description": "Priority assigned to the ticket.",
      "enum": [
        "LOW",
        "MEDIUM",
        "HIGH",
        "CRITICAL"
      ],
      "type": "string"
    },
    "host_address": {
      "description": "IP (v4/v6) address assigned to the communicating network interface.",
      "type": "string"
    }
  },
  "$defs": {
    "InvestigationState": {
      "description": "Incident investigation state.",
      "enum": [
        "NOT_STARTED",
        "INVESTIGATING",
        "TRIAGED",
        "FALSE_POSITIVE",
        "CLOSED"
      ],
      "type": "string"
    },
    "MitigationState": {
      "description": "Determines whether the threat was mitigated.",
      "enum": [
        "NOT_MITIGATED",
        "MITIGATED",
        "AUTO_MITIGATED"
      ],
      "type": "string"
    },
    "WorkloadInfo": {
      "description": "Workload specific information.\nAll fields are optional and can be omitted for host-less incident.\n",
      "type": "object",
      "properties": {
        "host_name": {
          "description": "Hostname of the source endpoint of the incident.",
          "type": "string"
        },
        "host_domain": {
          "description": "Domain or workgroup the host is part of.",
          "type": "string"
        },
        "host_address": {
          "description": "IP (v4/v6) address assigned to the communicating network interface.",
          "type": "string"
        },
        "agent_version": {
          "description": "Version of the running agent.",
          "type": "string"
        },
        "resource_id": {
          "description": "Unique identifier of the endpoint associated with this event, referencing the corresponding records in the event search system.",
          "type": "string",
          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        }
      }
    }
  }
}

Work with this as data

Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for schemas

4 MCP tools reach this
  • find_json_schemasBrowse and filter every JSON Schema in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This JSON Schema 
curl "https://apis.io/api/v1/json-schemas/acronis-incident-brief"
All schemas 
curl "https://apis.io/api/v1/json-schemas?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.