---
title: argusctl incidents
description: Triage queue (ML-flagged events).
---

# argusctl incidents



{/* AUTO-GENERATED by scripts/generate-cli-reference.mjs from `argusctl introspect --json`.
    Do not edit by hand. Regenerate with: pnpm generate:cli */}

> Generated from argusctl v0.1.0 on 2026-06-09. Run `argusctl introspect --json` for the machine-readable tree.

## `argusctl incidents`

Triage queue (ML-flagged events).

```bash
argusctl incidents <subcommand>
```

### `argusctl incidents list`

List recent enrichment records.

```bash
argusctl incidents list [options]
```

| Option                 | Description                                         |
| ---------------------- | --------------------------------------------------- |
| `--tenant <id>`        | filter by tenant\_id                                |
| `--classification <c>` | filter by classification (none \| aaa \| aa \| ...) |
| `--from <iso>`         | start of range (ISO-8601)                           |
| `--to <iso>`           | end of range (ISO-8601)                             |
| `-l, --limit <n>`      | max rows                                            |
| `--api <url>`          |                                                     |
| `--token <pat>`        |                                                     |
| `--json`               |                                                     |
| `--fields <list>`      |                                                     |


---

For a semantic overview of all documentation, see [/sitemap.md](/sitemap.md)

For an index of all available documentation, see [/llms.txt](/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/agents.md](/agents.md)