> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Alerts

Retrieve a list of alerts.

<Note>
  External Documentation

  To learn more, visit the [Microsoft Defender For Cloud Apps documentation](https://learn.microsoft.com/en-us/defender-cloud-apps/api-alerts-list#http-request).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter | Description                                                                                                                                                                                                                                                                                                                                                                                          |
  | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Filters   | Filter objects with all the search filters for the request, see [alert filters](https://learn.microsoft.com/en-us/defender-cloud-apps/api-alerts#filters) for more details.<br />For example, filter for open alerts form the last 2 days:<br /><pre><code>\{<br />	"alertOpen": \{<br />      "eq": true<br />    },<br />    "date": \{<br />      "lte\_ndays": 2 <br />    }<br />}</code></pre> |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter      | Description                                                                                                                                                 |
  | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Limit          | Number of records returned by the request.                                                                                                                  |
  | Skip           | Skips the specified number of records.                                                                                                                      |
  | Sort Direction | The sorting direction. Possible values are: `asc` and `desc`.                                                                                               |
  | Sort Field     | Fields used to sort alerts. Possible values are:<br />  - `date`: The date when then the alert was created.<br />  - `severity`: The severity of the alert. |
</div>

## Example Output

```json theme={"dark"}
{
	"data": [
		{
			"_id": "603f704aaf7417985bbf3b22",
			"contextId": "206e2965-6533-48a6-ba9e-794364a84bf9",
			"description": "Contoso user performed 11 suspicious activities MITRE Technique used Account Discovery (T1087) and subtechnique used Domain Account (T1087.002)",
			"entities": [
				{
					"entityRole": "Source",
					"entityType": 2,
					"id": "6204bdaf-ad46-4e99-a25d-374a0532c666",
					"inst": 0,
					"label": "user1",
					"pa": "user1@contoso.com",
					"saas": 11161,
					"type": "account"
				},
				{
					"entityRole": "Related",
					"id": "55017817-27af-49a7-93d6-8af6c5030fdb",
					"label": "DC3",
					"type": "device"
				},
				{
					"id": 20940,
					"label": "Active Directory",
					"type": "service"
				},
				{
					"entityRole": "Related",
					"id": "95c59b48-98c1-40ff-a444-d9040f1f68f2",
					"label": "DC4",
					"type": "device"
				},
				{
					"id": "5bfd18bfab73c36ba10d38ca",
					"label": "Honeytoken activity",
					"policyType": "ANOMALY_DETECTION",
					"type": "policyRule"
				},
				{
					"entityRole": "Source",
					"id": "34f3ecc9-6903-4df7-af79-14fe2d0d4553",
					"label": "Client1",
					"type": "device"
				},
				{
					"entityRole": "Related",
					"id": "d68772fe-1171-4124-9f73-0f410340bd54",
					"label": "DC1",
					"type": "device"
				},
				{
					"type": "groupTag",
					"id": "5f759b4d106abbe4a504ea5d",
					"label": "All Users"
				}
			],
			"idValue": 15795464,
			"isSystemAlert": false,
			"resolutionStatusValue": 0,
			"severityValue": 1,
			"statusValue": 1,
			"stories": [
				0
			],
			"threatScore": 34,
			"timestamp": 1621941916475,
			"title": "Honeytoken activity",
			"comment": "",
			"handledByUser": "administrator@contoso.com",
			"resolveTime": "2021-05-13T14:02:34.904Z",
			"URL": "https://contoso.portal.cloudappsecurity.com/#/alerts/603f704aaf7417985bbf3b22"
		}
	],
	"hasNext": false,
	"max": 1,
	"total": 1,
	"moreThanTotal": false
}
```

## Workflow Library Example

[List Alerts with Microsoft Defender for Cloud Apps and Send Results Via Email](https://library.blinkops.com/workflows/list-alerts-with-microsoft-defender-for-cloud-apps-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/list-alerts-with-microsoft-defender-for-cloud-apps-and-send-results-via-email/canvas" />
</div>