Actions129
- Calendar Permission Actions
- CIPP Administration Actions
- Execute API Client (GET)
- Execute Auto Backup
- Execute Extension Mapping (GET)
- Execute Extension Mapping (POST)
- Execute Extension Sync
- Execute Extensions Config
- Execute Password Config (POST)
- Execute Restore Backup
- Execute Run Backup
- List Custom Roles
- List Extension Sync
- List Logs
- List Scheduled Items
- Remove Scheduled Item
- Execute API Client (POST)
- Execute Extension Test
- Execute Password Config (GET)
- List Backups
- List Function Parameters
- Group Actions
- Intune Actions
- Add MSP App
- Add Office App
- Add Policy
- Add Store App
- Assign App
- Assign Autopilot Device
- Device Action
- Get Recovery Key
- List Applications
- List Application Queue
- List Autopilot Config
- List Devices
- List Intune Scripts
- List Intune Templates
- Remove Autopilot Device
- Remove Policy
- Remove Queued App
- Add Choco App
- Add WinGet App
- Assign Policy
- Get Local Admin Password
- List Autopilot Devices
- List Intune Policies
- Remove App
- Remove Intune Script
- Sync Autopilot Devices
- License Actions
- Security & Compliance Actions
- Teams & SharePoint Actions
- Tenant Actions
- Add Alert
- Clear Tenant Cache
- Execute CA Exclusion
- Execute Named Location
- Get Tenant
- List Alerts Queue
- List Azure AD Connect Status
- List Conditional Access Policies
- List Named Locations
- List Shared Mailbox Statistics
- List Standards
- List Tenants
- Remove Standard Template
- Add Named Location
- Edit Tenant
- Execute Standards Run
- List Audit Logs
- List CSP Licenses
- List Roles
- List Standard Templates
- Tool Actions
- User Actions
- Add User
- Exec Restore Deleted User
- List User
- List User Conditional Access Policies
- List User Groups
- Clear Immutable ID
- Create Temporary Access Password
- Delete User Device
- Dismiss Risky User
- List Deleted Items
- List Inactive Accounts
- List Sign-Ins
- Remove User
- Reset MFA
- Restore Deleted Item
- Revoke Sessions
- Set Email Forward
- Set Per-User MFA
- List All Users
- List User Counts
- List User Devices
- Convert Mailbox
- Disable User
- Enable Archive
- List MFA Users
- Offboard User
- Reset Password
- Send MFA Push
- Set Out of Office
Overview
This node interacts with the CIPP API to list security and compliance incidents for a specified tenant. It is useful for organizations that need to monitor and manage security incidents across their tenants, enabling automated workflows for incident tracking and response. For example, it can be used to fetch and analyze security incidents in a tenant's environment to trigger alerts or further investigation.
Use Case Examples
- List all security incidents for a tenant by providing the tenant ID or domain name.
- Automate the retrieval of security incidents to integrate with a ticketing system for incident management.
Properties
| Name | Meaning |
|---|---|
| Tenant Filter | The tenant ID or domain name to filter the incidents for. |
| Request Options | Settings to control request behavior such as batching, SSL certificate validation, proxy usage, and request timeout. |
Output
JSON
incidents- An array of security and compliance incidents retrieved from the CIPP API for the specified tenant.
Dependencies
- Requires an API key credential for authenticating with the CIPP API.
Troubleshooting
- Ensure the tenant filter is correctly specified as a valid tenant ID or domain name; incorrect values may result in no data or errors.
- If SSL certificate validation fails and the 'Ignore SSL Issues' option is not enabled, requests may be blocked; enable this option only if you trust the source.
- Proxy settings must be correctly configured if used; incorrect proxy URLs or credentials can cause request failures.
- Timeouts may occur if the server is slow to respond; increase the timeout setting if necessary.