External DocumentationTo learn more, visit the Panther documentation.
Parameters
| Parameter | Description |
|---|---|
| Alert ID | The alert ID to list events for. |
| Cursor | A token used to specify a results page. This value can be obtained from the endCursor property from a previous response. |
| Page Size | The maximum number of events to return in the response. Valid range is 1-50. |
Example Output
{
"data": {
"alert": {
"id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"events": {
"edges": [
{
"node": {
"createdAt": "2024-10-17 04:41:13.000000000",
"entitySnapshot": {
"cloudProviderURL": "https://ec2-xxx-xxx-xxx-xxx.compute.amazonaws.com:443",
"externalId": "https://ec2-xxx-xxx-xxx-xxx.compute.amazonaws.com:443/##TLS Handshake##0",
"id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"name": "Certificate for example.com",
"nativeType": "",
"providerId": "https://ec2-xxx-xxx-xxx-xxx.compute.amazonaws.com:443/##TLS Handshake##0",
"region": "",
"resourceGroupExternalId": "",
"subscriptionExternalId": "",
"subscriptionName": "",
"tags": {},
"type": "SECRET_INSTANCE"
},
"id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"notes": [],
"p_alert_context": {
"entity_snapshot": {
"cloudProviderURL": "https://ec2-xxx-xxx-xxx-xxx.compute.amazonaws.com:443",
"externalId": "https://ec2-xxx-xxx-xxx-xxx.compute.amazonaws.com:443/##TLS Handshake##0",
"id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"name": "Certificate for example.com",
"nativeType": "",
"providerId": "https://ec2-xxx-xxx-xxx-xxx.compute.amazonaws.com:443/##TLS Handshake##0",
"region": "",
"resourceGroupExternalId": "",
"subscriptionExternalId": "",
"subscriptionName": "",
"tags": {},
"type": "SECRET_INSTANCE"
},
"id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"mitre_attack_categories": [],
"type": "TOXIC_COMBINATION"
},
"p_alert_creation_time": "2024-10-17 04:47:52.000000000",
"p_alert_id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"p_alert_severity": "HIGH",
"p_alert_update_time": "2024-10-17 04:47:52.000000000",
"p_event_time": "2024-10-17 04:46:25.000000000",
"p_log_type": "Wiz.Issues",
"p_parse_time": "2024-10-17 04:46:25.000000000",
"p_row_id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"p_rule_id": "Wiz.Alert.Passthrough",
"p_rule_severity": "MEDIUM",
"p_schema_version": 0,
"p_source_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"p_source_label": "Source_Label_Placeholder",
"p_udm": {},
"serviceTickets": [],
"severity": "HIGH",
"sourceRule": {
"__typename": "Control",
"controlDescription": "",
"id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"name": "Secrets not stored in a secret container",
"resolutionRecommendation": "",
"securitySubCategories": null
},
"status": "OPEN",
"statusChangedAt": "2024-10-17 04:41:05.000000000",
"type": "TOXIC_COMBINATION",
"updatedAt": "2024-10-17 04:41:13.000000000"
}
}
],
"pageInfo": {
"endCursor": ""
}
}
}
}
}
Workflow Library Example
List Alert Events with Panther and Send Results Via Email