Read a persisted triage report
get_incident_reportRetrieve the persisted triage report for an incident ID to review findings or resume an investigation. Returns an error when no report exists.
Instructions
Read the latest persisted triage report for an incident id. Use after triage_incident, or to resume an investigation. Returns an error when no report exists. Read-only. Scope: aegis:read.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| incident_id | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| status | Yes | ||
| actions | No | ||
| sources | No | ||
| summary | Yes | Deterministic, template-generated summary | |
| coverage | Yes | ||
| findings | No | ||
| report_id | Yes | ||
| risk_band | Yes | ||
| incident_id | Yes | ||
| generated_at | Yes | ||
| trust_notice | No | Findings combine untrusted external feeds with deterministic local scoring. No text from a feed is executed. Confirm affected versions before remediation. | |
| max_risk_score | Yes | ||
| policy_version | No | risk-v1 | |
| reused_existing | No | ||
| partial_failures | No | ||
| asset_criticality | Yes | ||
| input_fingerprint | Yes |