Retrieving incident details using REST API call

You can use the incidents API to query incidents details and based on user authorization you can view the decrypted strings instead of viewing them on Trellix ePO → DLP Incident Manager.

GET request URL

https://<epo_server_name:port>/rest/dlp/incidents/{incident id}?incidentNature={n}

Where

epo_server_name:port is the server IP address and port number.
incident id is the number assigned to an incident.
incidentNature={n} incidents generated for data-in-use/motion and data-at-rest can have the same incident IDs, based on the value of n specified, incidents generated for different data vectors are retrieved.