> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-reference/investigations-and-incidents/view-an-incident.md).

# View an Incident

When you view an Incident, you will have access to all of the information our SOC analysts have. 

{% hint style="warning" %}
The information we gather in Workbench is retained for 15 months. After 15 months, it is permanently deleted.
{% endhint %}

## View All Incidents

The **Incidents** page shows you all of the Investigations for your environment. You can find it by going to **Activity > Incidents**.

{% hint style="info" %}
When you first open this page, you will see all Investigations sorted by the most recent. 
{% endhint %}

<figure><img src="/files/LI6LnKUabhsMOSUouDtD" alt="An image of the Incident page showing the list of Incidents."><figcaption></figcaption></figure>

## Find a Specific Incident

To find an Incident:

* You can search for its number using the **Search** field (every Incident has a number associated with it).
* You can use the **filter** options at the top of the page to filter by status, threat type, assignment, lead alert, etc.

Select the **blue name** of the Incident to open it. This is where you can view [Findings](/workbench-reference/expel-terminology.md#finding), [Investigative Actions](/workbench-reference/expel-terminology.md#investigative-action), [Remediation Actions](/workbench-reference/expel-terminology.md#remediation-action), a timeline, any custom rules, etc.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-reference/investigations-and-incidents/view-an-incident.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.