Get Device Affected By An Alert
Get specific device(s) affected by an alert. This action returns similar data to the Get Device action, except that only affected devices are returned. There is also an additional device field indicating if the alert is resolved for the device.
External Documentation
To learn more, visit the Medigate documentation.
Parameters
Parameter | Description |
---|---|
Alert ID | Alert ID, as indicated in the id field of an alert. |
Field | Specify the field by which to search for device(s). |
Fields | Specify which fields to return for each item. |
Value | Specify the search value. It can be either a single value or multiple values separated by commas. |
Example Output
{
"devices": [
{
"asset_id": "xxxxxxx",
"risk_score": "xxxxx",
"os_category": "xxxx",
"labels": [],
"device_type_family": "xxxxxxx",
"vlan_list": [x],
"mac_list": ["xxxxxxxxxxxx"],
"device_subcategory": "xxxxxxxxxxxxxx",
"retired": xxxx,
"assignees": [],
"uid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"network_list": ["xxxxxxxxx"],
"model": "xxxxxxxxxxxxxxx",
"device_type": "xxxxxxxx",
"device_category": "xxx",
"ip_list": ["xxx.xxx.xxx.xxx"],
"is_resolved": xxxx
}
]
}
Workflow Library Example
Get Device Affected by an Alert with Medigate and Send Results Via Email