> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Alerts

Retrieve a list of alerts matching the given criteria.

**Note:** Requires the `ReadOnly` role or higher.

<Note>
  External Documentation

  To learn more, visit the [Halcyon documentation](https://api.halcyon.ai/docs/index.html#operation/List%20Alerts).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter        | Description                                                   |
  | ---------------- | ------------------------------------------------------------- |
  | Action           | Select the action that was taken to filter results by.        |
  | Alert ID         | A comma-separated list of alert IDs to filter the results to. |
  | Display Status   | Select the display status to filter results by.               |
  | Last Seen After  | Return only alerts last seen after this date and time.        |
  | Last Seen Before | Return only alerts last seen before this date and time.       |
  | Page             | The page number of the results to retrieve.                   |
  | Page Size        | Select the number of results to return per page.              |
  | Return All Pages | Automatically fetch all resources, page by page.              |
  | Triage Status    | Select the triage status to filter results by.                |
  | Type             | Select the alert type to filter results by.                   |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter          | Description                                                                                                                               |
  | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
  | Count Greater Than | Return only alerts with an occurrence count greater than this value.                                                                      |
  | Count Less Than    | Return only alerts with an occurrence count less than this value.                                                                         |
  | First Seen After   | Return only alerts first seen after this date and time.                                                                                   |
  | First Seen Before  | Return only alerts first seen before this date and time.                                                                                  |
  | Offending Sha256   | A comma-separated list of `SHA256` hashes of the offending module. Returns all alerts whose `SHA256` starts with any of the given values. |
  | Sort By            | Select the field to sort the results by.                                                                                                  |
  | Sort Order         | Select the order of the sorted results.                                                                                                   |
</div>

## Example Output

```json theme={"dark"}
{
	"items": [
		{
			"action": "Block",
			"alertType": "BadBehavior",
			"assetCount": 0,
			"displayStatus": "Hidden",
			"firstOccurredAt": "2019-08-24T14:15:22Z",
			"id": "string",
			"kind": "BadFileExtension",
			"lastOccurredAt": "2019-08-24T14:15:22Z",
			"primaryProcess": {
				"artifact": {
					"filePath": "string",
					"kind": "Certificate",
					"sha256": "string"
				},
				"commandLine": "string",
				"kind": "DriverProcessResponse",
				"modules": [
					{
						"filePath": "string",
						"kind": "Certificate",
						"sha256": "string"
					}
				],
				"parentPid": "string",
				"pid": "string",
				"userId": "string",
				"username": "string"
			},
			"processes": [
				{
					"artifact": {
						"filePath": "string",
						"kind": "Certificate",
						"sha256": "string"
					},
					"commandLine": "string",
					"kind": "DriverProcessResponse",
					"modules": [
						{
							"filePath": "string",
							"kind": "Certificate",
							"sha256": "string"
						}
					],
					"parentPid": "string",
					"pid": "string",
					"userId": "string",
					"username": "string"
				}
			],
			"summary": {
				"artifact": {
					"classificationDetails": "string",
					"classificationType": "Benign",
					"filePath": "string",
					"kind": "Driver",
					"sha256": "string"
				},
				"badCommandLine": "string",
				"badExtension": "string",
				"kind": "DriverArtifactSummaryResponse"
			},
			"tenantId": "f97df110-f4de-492e-8849-4a6af68026b0",
			"totalOccurrences": 0,
			"triageStatus": "New"
		}
	],
	"pagination": {
		"currentPage": 0,
		"nextPage": 0,
		"previousPage": 0,
		"totalItems": 0,
		"totalPages": 0
	}
}
```

## Workflow Library Example

[List Alerts with Halcyon and Send Results Via Email](https://library.blinkops.com/workflows/list-alerts-with-halcyon-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/list-alerts-with-halcyon-and-send-results-via-email/canvas" />
</div>