Acronis · Schema

Incident

Complete Incident object.

CybersecurityData ProtectionEndpoint ManagementBackup and RecoveryDisaster RecoveryManaged Service ProvidersEndpoint Detection and ResponseCloud Storage

Properties

Name	Type	Description
incident_time	string	Deprecated - use created_at.
transferred_to_incident_id	string	An ID of the incident in case of this incident was transferred into another incident, potentially multi-workload.
state	string	Current state of the investigation in the EDR system.
workloads	array	List of associated workloads information for multi-workload incidents. "workloads" array is present only if incident involves multiple workloads, in that case WorkloadInfo fields at the root level are
ticket_subject	string	External ticket subject.
verdict	string	Is the incident considered malicious activity.
created_at	string	UTC timestamp of the incident creation.
host_name	string	Hostname of the source endpoint of the incident.
updated_at	string	UTC timestamp of the last incident update.
mdr_state	object	Last updated state of the investigation received from an MDR system, may include MDR specific states.
assignee	string	Name of an external agent assigned to the ticket.
detections	array	Array of detection objects, ordered by event_time ascending.
incident_actions	array	Array of available incident level response actions to be performed by MDR.
assignee_id	string	User ID of agent assigned to the ticket. Must contain an UUID of a registered user with access rights to the incident.
resource_id	string	Unique identifier of the endpoint associated with this event, referencing the corresponding records in the event search system.
positivity	number	Positivity score of the incident.
ticket_id	string	External ticket ID associated with the incident.
incident_id	string	ID of the incident object.
agent_version	string	Version of the running agent.
incident_short_id	integer	Short ID of the incident object in the context of a customer.
incident_link	string	Link to the incident investigation page.
mitigation_state	object
severity	string	Severity level of the incident.
incident_categories	array	Incident categories.
customer_id	string	ID of the customer.
activities	array	Array of activities, ordered by created time descending.
host_domain	string	Domain or workgroup the host is part of.
priority	string	Priority assigned to the ticket.
host_address	string	IP (v4/v6) address assigned to the communicating network interface.

View JSON Schema on GitHub

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/acronis/main/json-schema/acronis-incident-schema.json",
  "title": "Incident",
  "description": "Complete Incident object.",
  "x-generated": "2026-10-27",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/acronis-incidents-api-openapi.yml#/components/schemas/Incident",
  "type": "object",
  "required": [
    "incident_time",
    "state",
    "verdict",
    "created_at",
    "updated_at",
    "positivity",
    "incident_id",
    "mitigation_state",
    "severity"
  ],
  "properties": {
    "incident_time": {
      "description": "Deprecated - use created_at.",
      "type": "string",
      "format": "date-time"
    },
    "transferred_to_incident_id": {
      "description": "An ID of the incident in case of this incident was transferred into another incident,\npotentially multi-workload.\n",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "state": {
      "description": "Current state of the investigation in the EDR system.\n",
      "enum": [
        "NOT_STARTED",
        "INVESTIGATING",
        "TRIAGED",
        "FALSE_POSITIVE",
        "CLOSED"
      ],
      "type": "string"
    },
    "workloads": {
      "description": "List of associated workloads information for multi-workload incidents.\n\"workloads\" array is present only if incident involves multiple workloads,\nin that case WorkloadInfo fields at the root level are omitted.\n",
      "type": "array",
      "minItems": 2,
      "items": {
        "$ref": "#/$defs/WorkloadInfo"
      }
    },
    "ticket_subject": {
      "description": "External ticket subject.",
      "type": "string"
    },
    "verdict": {
      "description": "Is the incident considered malicious activity.",
      "enum": [
        "SUSPICIOUS",
        "MALICIOUS"
      ],
      "type": "string"
    },
    "created_at": {
      "description": "UTC timestamp of the incident creation.",
      "type": "string",
      "format": "date-time"
    },
    "host_name": {
      "description": "Hostname of the source endpoint of the incident.",
      "type": "string"
    },
    "updated_at": {
      "description": "UTC timestamp of the last incident update.",
      "type": "string",
      "format": "date-time"
    },
    "mdr_state": {
      "description": "Last updated state of the investigation received from an MDR system, may include MDR specific states.\n",
      "anyOf": [
        {
          "$ref": "#/$defs/InvestigationState"
        },
        {
          "type": "string"
        }
      ]
    },
    "assignee": {
      "description": "Name of an external agent assigned to the ticket.",
      "type": "string"
    },
    "detections": {
      "description": "Array of detection objects, ordered by event_time ascending.",
      "type": "array",
      "items": {
        "$ref": "#/$defs/Detection"
      }
    },
    "incident_actions": {
      "description": "Array of available incident level response actions to be performed by MDR.",
      "type": "array",
      "items": {
        "$ref": "#/$defs/ResponseAction"
      }
    },
    "assignee_id": {
      "description": "User ID of agent assigned to the ticket.\nMust contain an UUID of a registered user with access rights to the incident.\n",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "resource_id": {
      "description": "Unique identifier of the endpoint associated with this event, referencing the corresponding records in the event search system.",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "positivity": {
      "description": "Positivity score of the incident.",
      "type": "number",
      "format": "float",
      "minimum": 0,
      "maximum": 10
    },
    "ticket_id": {
      "description": "External ticket ID associated with the incident.",
      "type": "string"
    },
    "incident_id": {
      "description": "ID of the incident object.",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "agent_version": {
      "description": "Version of the running agent.",
      "type": "string"
    },
    "incident_short_id": {
      "description": "Short ID of the incident object in the context of a customer.",
      "type": "integer",
      "format": "int32",
      "minimum": 1
    },
    "incident_link": {
      "description": "Link to the incident investigation page.",
      "type": "string"
    },
    "mitigation_state": {
      "$ref": "#/$defs/MitigationState"
    },
    "severity": {
      "description": "Severity level of the incident.",
      "enum": [
        "LOW",
        "MEDIUM",
        "HIGH",
        "CRITICAL"
      ],
      "type": "string"
    },
    "incident_categories": {
      "description": "Incident categories.",
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {
        "description": "Incident threat category.",
        "enum": [
          "MALWARE_DETECTED",
          "PROCESS_DETECTED",
          "MBR_ACTIVITY_BLOCKED",
          "URL_BLOCKED",
          "WEBSITE_URL_BLOCKED",
          "MS_DEFENDER",
          "THIRD_PARTY_OTHER",
          "UNKNOWN_CATEGORY"
        ],
        "type": "string"
      }
    },
    "customer_id": {
      "description": "ID of the customer.",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "activities": {
      "description": "Array of activities, ordered by created time descending.",
      "type": "array",
      "items": {
        "$ref": "#/$defs/Activity"
      }
    },
    "host_domain": {
      "description": "Domain or workgroup the host is part of.",
      "type": "string"
    },
    "priority": {
      "description": "Priority assigned to the ticket.",
      "enum": [
        "LOW",
        "MEDIUM",
        "HIGH",
        "CRITICAL"
      ],
      "type": "string"
    },
    "host_address": {
      "description": "IP (v4/v6) address assigned to the communicating network interface.",
      "type": "string"
    }
  },
  "$defs": {
    "Activity": {
      "description": "Activity (includes comments, response actions and user incident actions).",
      "type": "object",
      "required": [
        "activity_id",
        "type",
        "entity_type",
        "origin",
        "created_at",
        "updated_at"
      ],
      "properties": {
        "activity_id": {
          "$ref": "#/$defs/ActivityID"
        },
        "type": {
          "description": "Activity type.",
          "anyOf": [
            {
              "$ref": "#/$defs/IncidentActivityType"
            },
            {
              "$ref": "#/$defs/ResponseActionType"
            }
          ]
        },
        "entity_type": {
          "description": "Type of the entity the action is applied to.",
          "enum": [
            "INCIDENT",
            "WORKLOAD",
            "PROCESS",
            "FILE",
            "REGISTRY",
            "NETWORK",
            "SCHEDULED_TASK",
            "EXTERNAL"
          ],
          "type": "string"
        },
        "entity_name": {
          "description": "Short name (caption) of the entity (filename, workload name etc).\nOmitted for entity_type = \"INCIDENT\" or when target contains more than 1 item.\n",
          "type": "string"
        },
        "workload_id": {
          "description": "Unique ID of the workload for the activity.",
          "type": "string",
          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        "origin": {
          "$ref": "#/$defs/ActivityOrigin"
        },
        "user": {
          "description": "User who initiated the action (for origin = \"USER\")",
          "type": "object",
          "required": [
            "name",
            "id"
          ],
          "properties": {
            "name": {
              "description": "Person name.",
              "type": "string"
            },
            "id": {
              "description": "Person ID.",
              "type": "string",
              "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
            }
          }
        },
        "created_at": {
          "description": "UTC Timestamp when activity was created (for response actions - queued).",
          "type": "string",
          "format": "date-time"
        },
        "updated_at": {
          "description": "UTC Timestamp when action status was updated.",
          "type": "string",
          "format": "date-time"
        },
        "started_at": {
          "description": "UTC Timestamp when activity started execution.",
          "type": "string",
          "format": "date-time"
        },
        "completed_at": {
          "description": "UTC Timestamp when action was finished.",
          "type": "string",
          "format": "date-time"
        },
        "status": {
          "$ref": "#/$defs/ActivityStatus"
        },
        "comment": {
          "description": "User comment.",
          "type": "string"
        },
        "err_message": {
          "description": "Error or warning text.",
          "type": "string"
        },
        "additional_info": {
          "description": "Activity type-specific details. Selector is 'type' field. Provided by UI.\nFor user activities (comment, set assignee, etc) is generated by DB.\n",
          "type": "object"
        },
        "execution_state": {
          "description": "Activity execution state (outcome). Content schema depends on 'type'.\nProvided by response action execution layer.\nOmitted for user activity.\nFor XDR actions XDRProcessingResultCollection result would be added here.\n",
          "type": "object"
        }
      }
    },
    "ActivityID": {
      "description": "Activity ID.",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "ActivityOrigin": {
      "description": "The origin of the activity.",
      "enum": [
        "USER",
        "SYSTEM",
        "AGENT",
        "THREAT_FEED",
        "WORKFLOW"
      ],
      "type": "string"
    },
    "ActivityStatus": {
      "description": "Activity status.",
      "anyOf": [
        {
          "$ref": "#/$defs/InProgressState"
        },
        {
          "$ref": "#/$defs/CompletionStatus"
        }
      ]
    },
    "CompletionStatus": {
      "description": "Execution state of the activity.",
      "enum": [
        "SUCCEEDED",
        "SUCCEEDED_WITH_WARNINGS",
        "FAILED",
        "SKIPPED",
        "TIMED_OUT",
        "CANCELLED"
      ],
      "type": "string"
    },
    "Detection": {
      "type": "object",
      "required": [
        "engine",
        "event_id",
        "event_time",
        "description"
      ],
      "properties": {
        "workload_id": {
          "description": "Unique ID of the workload where the detection occurred.\nMay be omitted for host-less and single workload incidents.\n",
          "type": "string",
          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        "engine": {
          "description": "Type of detection engine.",
          "enum": [
            "FILE",
            "URLF",
            "BEHAVIORAL",
            "PROCESS"
          ],
          "type": "string"
        },
        "event_id": {
          "description": "Identifier of the event associated with this detection, referencing the corresponding record in event search.",
          "type": "string",
          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        "event_time": {
          "description": "UTC Timestamp of the activity taking place on the endpoint.",
          "type": "string",
          "format": "date-time"
        },
        "description": {
          "description": "Description of the object, such as rule description or attack stage.",
          "type": "string"
        },
        "threat_name": {
          "description": "Threat name.",
          "type": "string"
        },
        "verdict": {
          "description": "Detection malice verdict.",
          "enum": [
            "SUSPICIOUS",
            "MALICIOUS"
          ],
          "type": "string"
        },
        "is_trigger": {
          "description": "Was detection a trigger for an incident.",
          "type": "boolean"
        }
      }
    },
    "InProgressState": {
      "description": "State of the activity that is in progress.",
      "enum": [
        "QUEUED",
        "DEPENDENT",
        "STARTED"
      ],
      "type": "string"
    },
    "IncidentActivityType": {
      "description": "Incident activity type.",
      "enum": [
        "ADD_COMMENT",
        "SET_ASSIGNEE",
        "CHANGE_INVESTIGATION_STATE",
        "CHANGE_THREAT_STATUS"
      ],
      "type": "string"
    },
    "InvestigationState": {
      "description": "Incident investigation state.",
      "enum": [
        "NOT_STARTED",
        "INVESTIGATING",
        "TRIAGED",
        "FALSE_POSITIVE",
        "CLOSED"
      ],
      "type": "string"
    },
    "MitigationState": {
      "description": "Determines whether the threat was mitigated.",
      "enum": [
        "NOT_MITIGATED",
        "MITIGATED",
        "AUTO_MITIGATED"
      ],
      "type": "string"
    },
    "ParameterProperty": {
      "description": "Parameter definition modeled after RAML spec.",
      "type": "object",
      "required": [
        "type"
      ],
      "properties": {
        "type": {
          "enum": [
            "integer",
            "number",
            "string"
          ],
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "minimum": {
          "type": "number"
        },
        "maximum": {
          "type": "number"
        }
      }
    },
    "QueryParameters": {
      "description": "Query Parameters definition modeled after RAML spec.",
      "type": "object",
      "patternProperties": {
        "^.*$": {
          "$ref": "#/$defs/ParameterProperty"
        }
      }
    },
    "ResponseAction": {
      "description": "Definition of available Response Action and its status if it's already initiated.",
      "type": "object",
      "required": [
        "action"
      ],
      "properties": {
        "activity_id": {
          "description": "Activity ID corresponding to the initiated response action.",
          "type": "string",
          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        "workload_id": {
          "description": "Workload ID where the action should be performed.  Provided for (potentially) multi-workload incidents.\n",
          "type": "string",
          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        "action": {
          "description": "Action, e.g., \"WORKLOAD_ISOLATE\".",
          "anyOf": [
            {
              "$ref": "#/$defs/ResponseActionPredefined"
            },
            {
              "type": "string"
            }
          ]
        },
        "query_parameters": {
          "$ref": "#/$defs/QueryParameters"
        },
        "uri": {
          "description": "Post URI for triggering of the response action. Ommited for completed or in-progress actions.",
          "type": "string"
        },
        "display_name": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "status": {
          "description": "Optional Activity status for the response action if it was already invoked.",
          "anyOf": [
            {
              "$ref": "#/$defs/InProgressState"
            },
            {
              "$ref": "#/$defs/CompletionStatus"
            }
          ]
        }
      }
    },
    "ResponseActionPredefined": {
      "description": "Predefined Response Action type.",
      "enum": [
        "WORKLOAD_ISOLATE",
        "WORKLOAD_DEISOLATE",
        "WORKLOAD_RESTART",
        "WORKLOAD_SHUTDOWN",
        "ADD_ALL_PROCESS_FILE_URL_TO_ALLOW_LIST",
        "ADD_ALL_PROCESS_FILE_URL_TO_BLOCK_LIST",
        "PROCESS_STOP_TREE",
        "PROCESS_STOP",
        "PROCESS_FILE_QUARANTINE",
        "PROCESS_FILE_DELETE",
        "ADD_TO_BLOCK",
        "ADD_TO_ALLOW",
        "ACQUIRE_FORENSIC_BACKUP",
        "WORKLOAD_ROLLBACK",
        "WORKLOAD_PATCH"
      ],
      "type": "string"
    },
    "ResponseActionType": {
      "description": "Response action type.",
      "enum": [
        "FIND_ROLLBACK_ITEMS",
        "SMART_REMEDIATION_TRUE_POSITIVE",
        "SMART_REMEDIATION_FALSE_POSITIVE",
        "WORKLOAD_MANAGE_ISOLATION",
        "WORKLOAD_ISOLATE",
        "WORKLOAD_MANAGE_DEISOLATION",
        "WORKLOAD_DEISOLATE",
        "WORKLOAD_PATCH",
        "WORKLOAD_BACKUP",
        "WORKLOAD_FORENSIC_BACKUP",
        "WORKLOAD_RECOVERY_FROM_BACKUP",
        "WORKLOAD_DR_FAILOVER",
        "WORKLOAD_RESTART",
        "WORKLOAD_SHUTDOWN",
        "WORKLOAD_ISOLATE_EXCLUSIONS_ADD",
        "PROCESS_STOP",
        "PROCESS_STOP_TREE",
        "PROCESS_QUARANTINE",
        "PROCESS_DELETE_IMAGE",
        "PROCESS_ADD_TO_ALLOW_LIST",
        "PROCESS_ADD_TO_BLOCK_LIST",
        "PROCESS_REMOVE_FROM_ALLOW_LIST",
        "PROCESS_REMOVE_FROM_BLOCK_LIST",
        "PROCESS_MANAGE_ROLLBACK",
        "PROCESS_FLUSH_EVENTS",
        "PROCESS_ROLLBACK_CHANGES",
        "FILE_DELETE",
        "FILE_QUARANTINE",
        "FILE_ADD_TO_ALLOW_LIST",
        "FILE_ADD_TO_BLOCK_LIST",
        "FILE_REMOVE_FROM_ALLOW_LIST",
        "FILE_REMOVE_FROM_BLOCK_LIST",
        "REGISTRY_DELETE",
        "NETACCESS_ADD_TO_ALLOW_LIST",
        "NETACCESS_ADD_TO_BLOCK_LIST",
        "NETACCESS_REMOVE_FROM_ALLOW_LIST",
        "NETACCESS_REMOVE_FROM_BLOCK_LIST",
        "XDR_RESPONSE_ACTION",
        "WORKLOAD_REMOTE_DESKTOP",
        "WORKLOAD_CYBERSCRIPTING"
      ],
      "type": "string"
    },
    "WorkloadInfo": {
      "description": "Workload specific information.\nAll fields are optional and can be omitted for host-less incident.\n",
      "type": "object",
      "properties": {
        "host_name": {
          "description": "Hostname of the source endpoint of the incident.",
          "type": "string"
        },
        "host_domain": {
          "description": "Domain or workgroup the host is part of.",
          "type": "string"
        },
        "host_address": {
          "description": "IP (v4/v6) address assigned to the communicating network interface.",
          "type": "string"
        },
        "agent_version": {
          "description": "Version of the running agent.",
          "type": "string"
        },
        "resource_id": {
          "description": "Unique identifier of the endpoint associated with this event, referencing the corresponding records in the event search system.",
          "type": "string",
          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        }
      }
    }
  }
}

Work with this as data

Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for schemas

4 MCP tools reach this

find_json_schemasBrowse and filter every JSON Schema in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This JSON Schema

curl "https://apis.io/api/v1/json-schemas/acronis-incident"

All schemas

curl "https://apis.io/api/v1/json-schemas?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.