| Name | Description | |
|---|---|---|
 | Active | Overloaded. Active incidents |
| Add | Overloaded. Allow for the saving of firewall disk violations |
| All | Overloaded. Get all incidents active and inactive |
| Attacks | Attacks counted in time-frame |
| CountBlockedUsers | count all users that are currently blocked |
| ExpiredActiveIncidents | Get expired active incidents |
| GetDiskChanges | get all disk changes around a specific date |
| Inactive | Overloaded. Get all incidents that are no-longer active for a given date range |
 | Instance | Access the default IIncidentDatabase instance used by the firewall |
| ISPIncidents | get the ISP incident stats |
| QueryIncidents | Queries the incidents for a page request (max 20 min old). |
| RecordDiscovery | Record user discovery for a page |
| RecordIgnoredIncident | record the suppressed incident |
| Save | Save data into long term storage |
| TryGet | tries and retrieves a entry out of the firewall for the user and IP |
| TryGetAbuseReport | get the abuse report belonging to the report ID |
| TryPop | tries to remove an entry for the user if it exists |
| TrySave | Save data into long term storage |
| UpdateExpiry | update the expiry data for the incident |
| UpdateInterceptLocation | Overloaded. updates the intercept location for reporting by the tool doing the intercepting |
| UpdateWhois | Updates and saves the WHOIS assignment for the IP address |
| Where | Retrieve the incidents that are missing data |