Incidents

Incidents track security events that need investigation and resolution. Available on Enterprise.

Creating Incidents

Create incidents from alerts or manually when a security event is detected:

python

import asqav

# Initialize with your API key
asqav.init(api_key="sk_...")

# Create an incident manually
incident = Asqav.Incident.create(
    title="Unauthorized API access detected",
    severity="high",
    description="Agent agent_abc123 made requests outside its allowed scope"
)

print(f"Incident ID: {incident.id}")
print(f"Status: {incident.status}")

Or create an incident from an existing alert:

python

incident = Asqav.Incident.create_from_alert(
    alert_id="alert_xyz789",
    severity="critical"
)

print(f"Linked alert: {incident.alert_id}")

Incident Severity

Incidents are classified by severity level:

Severity	Description
`low`	Minor issue, no immediate action required
`medium`	Notable event, investigate when possible
`high`	Significant threat, requires prompt investigation
`critical`	Active breach or compromise, immediate response needed

Incident Status

Track incidents through their lifecycle:

Status	Description
`open`	Newly created, awaiting triage
`investigating`	Actively being investigated
`mitigated`	Threat contained, pending full resolution
`resolved`	Root cause addressed, monitoring for recurrence
`closed`	Fully resolved and documented

Listing Incidents

Retrieve incidents with optional filters:

python

# List all open incidents
incidents = Asqav.Incident.list(status="open")
for inc in incidents:
    print(f"{inc.id}: {inc.title} [{inc.severity}]")

# Filter by severity
critical = Asqav.Incident.list(severity="critical")

# Filter by date range
recent = Asqav.Incident.list(
    created_after="2026-03-01T00:00:00Z",
    created_before="2026-03-31T23:59:59Z"
)

Updating Incidents

Update incident status as investigation progresses:

python

# Get an existing incident
incident = Asqav.Incident.get("inc_abc123")

# Move to investigating
incident.update(
    status="investigating",
    notes="Reviewing agent activity logs for the past 24 hours"
)

# Resolve the incident
incident.update(
    status="resolved",
    resolution="Agent scope was misconfigured. Updated policy and revoked excess permissions."
)

Tip

Create incidents from alerts using create_from_alert() to automatically link the alert context, affected agents, and timeline to the incident.