[ACTION] Huntress new actions

# [Action] List Incident Reports
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
GET /v1/incident_reports

**Problem**
A user needs to programmatically retrieve security incidents to monitor their environment or feed data into downstream security workflows. Without this action, discovering new threats requires manual portal intervention.

**What's needed**
Add a `List Incident Reports` action.

**Prop Definitions**
- `limit`: (Integer) Max number of resources returned in a paged collection.
- `page_token`: (String) Token used to request the next page in paginated results.
- `indicator_type`: (String) Filter by indicator type (e.g., footholds, ransomware_canaries).
- `status`: (String) Filter by status (e.g., sent, closed, dismissed).
- `severity`: (String) Filter by severity (low, high, critical).

**Notes**
- Endpoint: GET /v1/incident_reports
- Use Case: Retrieve a filtered list of security incidents by status, severity, or platform.

---

# [Action] Get Incident Report
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
GET /v1/incident_reports/{id}

**Problem**
To perform automated remediation or detailed analysis, an agent needs the full payload and analyst summaries of a specific incident.

**What's needed**
Add a `Get Incident Report` action.

**Prop Definitions**
- `id`: (String) The unique identifier for an incident report. Use `List Incident Reports` to find available IDs.

**Notes**
- Endpoint: GET /v1/incident_reports/{id}
- Use Case: Retrieve full details and SOC analyst summaries for a specific incident.

---

# [Action] Resolve Incident Report
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
POST /v1/incident_reports/{id}/resolution

**Problem**
Once an incident is handled via automation, the status must be updated in Huntress to maintain accurate security reporting and clear SOC queues.

**What's needed**
Add a `Resolve Incident Report` action.

**Prop Definitions**
- `id`: (String) The unique identifier for the incident report to resolve.

**Notes**
- Endpoint: POST /v1/incident_reports/{id}/resolution
- Use Case: Mark an incident as resolved once all remediations are approved or completed.

---

# [Action] Bulk Approve Remediations
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
POST /v1/incident_reports/{id}/remediations/bulk_approval

**Problem**
Assisted remediations require approval before execution. Approving steps one-by-one is inefficient for large-scale incidents.

**What's needed**
Add a `Bulk Approve Remediations` action.

**Prop Definitions**
- `id`: (String) The unique identifier for the incident report whose remediations should be approved.

**Notes**
- Endpoint: POST /v1/incident_reports/{id}/remediations/bulk_approval
- Use Case: Authorize all pending remediation steps to immediately trigger automated cleanup.

---

# [Action] List Remediations
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
GET /v1/incident_reports/{id}/remediations

**Problem**
An agent needs to understand the specific steps required for a fix to decide if it should be approved or escalated to a human.

**What's needed**
Add a `List Remediations` action.

**Prop Definitions**
- `id`: (String) The unique identifier for the incident report.
- `types[]`: (Array) Filter by type (assisted, manual, containment).
- `statuses[]`: (Array) Filter by status (unapproved, approved, completed, failed, cancelled).

**Notes**
- Endpoint: GET /v1/incident_reports/{id}/remediations
- Use Case: View specific manual or assisted steps required to resolve an incident.

---

# [Action] List Agents
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
GET /v1/agents

**Problem**
Visibility into endpoint health and connection status is critical for ensuring security coverage across the fleet.

**What's needed**
Add a `List Agents` action.

**Prop Definitions**
- `limit`: (Integer) Max number of resources to return.
- `organization_id`: (String) Filter by a specific organization ID.
- `platform`: (String) Filter by platform (windows, darwin, linux).

**Notes**
- Endpoint: GET /v1/agents
- Use Case: Monitor endpoint health, OS versions, and connection status across the fleet.

---

# [Action] Get Agent
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
GET /v1/agents/{id}

**Problem**
To troubleshoot specific device vulnerabilities or policy failures, an agent needs the full technical details of an endpoint.

**What's needed**
Add a `Get Agent` action.

**Prop Definitions**
- `id`: (String) The unique identifier for the agent.

**Notes**
- Endpoint: GET /v1/agents/{id}
- Use Case: Get detailed hardware, OS build, and security policy status for a specific machine.

---

# [Action] Find Agents by Organization
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
GET /v1/agents?organization_id={id}

**Problem**
For multi-tenant management, a user often needs to isolate work to a single customer's endpoints.

**What's needed**
Add a `Find Agents by Organization` action.

**Prop Definitions**
- `id`: (String) The unique identifier for the organization. Use `List Organizations` to find this ID.

**Notes**
- Endpoint: GET /v1/agents?organization_id={id}
- Use Case: Retrieve all endpoints belonging to a specific customer or site.

---

# [Action] List Organizations
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
GET /v1/organizations

**Problem**
Organization IDs are required for almost every scoped API call. Agents need to resolve organization names to IDs to operate effectively.

**What's needed**
Add a `List Organizations` action.

**Prop Definitions**
- `limit`: (Integer) Max number of results.
- `page_token`: (String) Pagination token.

**Notes**
- Endpoint: GET /v1/organizations
- Use Case: Retrieve all managed customers to resolve names to organizational IDs.

---

# [Action] Create Organization
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
POST /v1/organizations

**Problem**
Automating customer onboarding requires the ability to create new organization containers and retrieve deployment keys without manual portal entry.

**What's needed**
Add a `Create Organization` action.

**Prop Definitions**
- `name`: (String) The public facing name for this organization.
- `key`: (String) The organization key used to associate agents with this group.

**Notes**
- Endpoint: POST /v1/organizations
- Use Case: Provision a new organization and generate a unique organization key for agent deployment.

---

# [Action] Update Organization
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
PATCH /v1/organizations/{id}

**Problem**
Changes to customer names or security notification lists need to be synced from external systems (like a CRM or PSA) into Huntress.

**What's needed**
Add an `Update Organization` action.

**Prop Definitions**
- `id`: (String) The unique identifier for the organization to update.
- `name`: (String) Updated organization name.
- `report_recipients`: (Array) Updated list of notification email addresses.

**Notes**
- Endpoint: PATCH /v1/organizations/{id}
- Use Case: Update organization names or adjust report recipient email lists.

---

# [Action] Delete Organization
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
DELETE /v1/organizations/{id}

**Problem**
When a customer is offboarded, the organization and its associated agents must be removed to stop data collection and billing.

**What's needed**
Add a `Delete Organization` action.

**Prop Definitions**
- `id`: (String) The unique identifier for the organization to delete.

**Notes**
- Endpoint: DELETE /v1/organizations/{id}
- Use Case: Offboard a customer by deleting their organization and uninstalling all associated agents.

---

# [Action] List Escalations
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
GET /v1/escalations

**Problem**
Escalations represent critical issues that require manual configuration or partner input. These need to be monitored to ensure platform health.

**What's needed**
Add a `List Escalations` action.

**Prop Definitions**
- `status`: (String) Filter by status (open, overdue, resolved).
- `limit`: (Integer) Max number of results.

**Notes**
- Endpoint: GET /v1/escalations
- Use Case: Identify items requiring partner attention, such as integration issues or VPN authorization.

---

# [Action] Resolve Escalation
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
POST /v1/escalations/{id}/resolution

**Problem**
After fixing an integration or verifying a login, an agent must resolve the escalation to clear the alert state.

**What's needed**
Add a `Resolve Escalation` action.

**Prop Definitions**
- `id`: (String) The unique identifier for the escalation.

---

# [Action] List Identities
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
GET /v1/identities

**Problem**
Compromised identities are a primary vector for attacks. Monitoring risk levels and MFA compliance across cloud tenants is essential for identity protection.

**What's needed**
Add a `List Identities` action.

**Prop Definitions**
- `organization_id`: (String) Filter by organization.
- `risk_level`: (String) Filter by risk (none, low, medium, high).
- `mfa_enabled`: (Boolean) Filter by MFA status.

**Notes**
- [cite_start]Endpoint: GET /v1/identities
- [cite_start]Use Case: Audit user risk levels and MFA status across Microsoft 365 or Google Workspace.

---

# [Action] Execute SIEM Query
**Is there a specific app this action is for?**
Huntress

**Please provide a link to the relevant API docs for the specific service / operation.**
POST /v1/siem/query

**Problem**
Standard dashboard views don't always catch complex behavioral patterns. Advanced hunting requires raw log access via ESQL queries.

**What's needed**
Add an `Execute SIEM Query` action.

**Prop Definitions**
- [cite_start]`esql`: (String) The ESQL query string (must begin with `FROM logs`).
- `range_start`: (String) ISO 8601 query range start.
- `range_end`: (String) ISO 8601 query range end.

**Notes**
- Endpoint: POST /v1/siem/query
- Use Case: Perform advanced behavioral hunting using ESQL against raw SIEM logs.