The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Process incidents with the after parameter

Prev Next

The most reliable method to process incidents from the events API is to use a pagination cursor from the after parameter. This method ensures that incidents aren't skipped or duplicated due to the lack of time stamp precision.

These are the general sequence of steps to follow when applying the after parameter:

  1. Issue an initial request using the request parameters and since with a value set to a date in the last 60 minutes.

  2. Retrieve the next page of incidents through the Link response header value within the next link relationship.

  3. Issue the paginated request.

  4. Pause and repeat step 2.

Note

If there is no next link in the response header, you have received all incidents for the time period specified in the original request.