List Alerts - BlinkOps Documentation

List the alerts that match the specified filter. Required Scope: https://www.googleapis.com/auth/cloud-platform. Required IAM Permission on the parent’s resource: threatintelligence.alerts.list.

External DocumentationTo learn more, visit the Google Threat Intelligence documentation.

Parameters

Parameter	Description
Filter	A filter expression to select the alerts to return. Commonly used fields include `state`, `audit.create_time`, `detail.detail_type`, `severityAnalysis.severity_level` and `priorityAnalysis.priority_level`. For Example: `state = "NEW" OR state = "TRIAGED"` For more information about the supported fields, refer to Google Threat Intelligence documentation.
Order By	A comma-separated list of fields to sort the alerts by. Add `desc` after a field to sort it in descending order. The supported fields are the same as in `Filter`. For Example: `audit.create_time desc, severityAnalysis.severity_level desc`
Page Size	The maximum number of alerts to return per page. Values can range from `1` to `1000`. Defaults to `100`.
Page Token	The `nextPageToken` value returned by a previous call, used to get the next page of alerts.
Return All Pages	Automatically fetch all resources, page by page.

Example Output

{
	"alerts": [
		{
			"name": "projects/my-gti-project/alerts/6f1c2a9e-3b7d-4e52-9a10-2c8d4f7b1e03",
			"findings": [
				"projects/my-gti-project/findings/0b9e4d21-7c3a-4f68-8e55-1a2b3c4d5e6f"
			],
			"state": "NEW",
			"audit": {
				"createTime": "2026-10-20T08:14:22.512Z",
				"updateTime": "2026-10-21T11:03:47.090Z",
				"creator": "system",
				"updater": "analyst@example.com"
			},
			"displayName": "Credentials for example.com found in a data leak",
			"detail": {
				"detailType": "data_leak",
				"dataLeak": {
					"severity": "HIGH",
					"discoveryDocumentIds": [
						"doc-8f2e1c7a9b"
					]
				}
			},
			"etag": "W/\"a1b2c3d4\"",
			"aiSummary": "Employee credentials for example.com were posted to a paste site.",
			"relevanceAnalysis": {
				"relevant": true,
				"confidence": "CONFIDENCE_LEVEL_HIGH",
				"reasoning": "The leaked credentials belong to the example.com domain, which is in scope.",
				"evidence": {
					"commonThemes": [
						"example.com"
					],
					"distinctThemes": []
				},
				"relevanceLevel": "RELEVANCE_LEVEL_HIGH"
			},
			"severityAnalysis": {
				"severityLevel": "SEVERITY_LEVEL_HIGH",
				"confidence": "CONFIDENCE_LEVEL_MEDIUM",
				"reasoning": "The credentials include plaintext passwords."
			},
			"priorityAnalysis": {
				"priorityLevel": "PRIORITY_LEVEL_HIGH",
				"confidence": "CONFIDENCE_LEVEL_MEDIUM",
				"reasoning": "High relevance and high severity."
			},
			"findingCount": "1",
			"configurations": [
				"projects/my-gti-project/configurations/2d7a9c41-5e3b-4f80-b1c2-9e8d7f6a5b4c"
			]
		}
	],
	"nextPageToken": "CiAKGjBpNDd2Nmp2Zml2cXRwYjBpOXA"
}

Workflow Library Example

List Alerts with Google Threat Intelligence and Send Results Via Email

Preview this Workflow on desktop