> ## Documentation Index > Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt > Use this file to discover all available pages before exploring further. # Search Alerts Get a list of alerts with optional filtering. External Documentation To learn more, visit the [Rapid7 InsightIDR documentation](https://docs.rapid7.com/insightidr/api/alert-triage/#tag/Alerts/operation/searchAlerts). ## Basic Parameters
| Parameter | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | End Time | The end of the timeframe to search alerts until. | | LEQL expression | The LEQL `WHERE` query to match the search against.

**For Example:**
- `where(status = 'OPEN' AND priority = 'CRITICAL')` - all alerts that are currently open and have been marked with critical priority.
- `where(assignee.email = 'analyst.name@company.com' AND status = 'INVESTIGATING')` - all alerts currently being investigated by a specific analyst. | | Page | The number of the page to return results from (zero-based). | | Page Size | The maximum number of results to return per page. Valid range is `1-100` | | RRNs Only | Select to return only RRNs (Rapid7 Resource Names) without alert details. | | Return All Pages | Automatically fetch all resources, page by page. | | Start Time | The start of the timeframe to search alerts from. | | Terms | An array of search terms to match the search against.

**For Example:**
\[
    \{
      "field\_ids": \["string"],
      "operator": "EQUALS",
      "terms": \[
        "string",
        "2025-10-23T12:17:24.622Z",
        0,
        true
      ]
    }
  ]

**Notes:**
- Field IDs can be obtained using `Get All Alert Fields` action.
- Available options for operators: `EQUALS`, `NOT_SET`, `NOT_EQUALS`, `CONTAINS`, `GREATER_THAN`, `LESS_THAN`.
- Available options for terms: `string`, `string `, `number`, `boolean`.

For more information, please refer to [Rapid7 - Insight IDR Documentation](https://docs.rapid7.com/insightidr/api/alert-triage/#tag/Alerts/operation/searchAlerts) |
## Advanced Parameters
| Parameter | Description | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Additional Field IDs | A comma-separated list of additional field IDs to include for each alert in the result.

For more information, please refer to [Rapid7 - Insight IDR Documentation](https://docs.rapid7.com/insightidr/api/alert-triage/#tag/Alerts/operation/searchAlerts) | | Aggregates | An array of aggregations to apply for all matching results.

**For Example:**

\[
    \{
      "name": "string",
      "type": "BUCKET",
      "fields": \[
        \{
          "field\_id": "string",
          "interval": 0,
          "order": "ASCENDING\_NULLS\_LAST"
        }
      ],
      "count\_order": "ASCENDING\_NULLS\_LAST"
    }
  ]
**Note:** Each object must include `name` and `fields` attributes.

For more information, please refer to [Rapid7 - Insight IDR Documentation](https://docs.rapid7.com/insightidr/api/alert-triage/#tag/Alerts/operation/searchAlerts) | | Sorts | An array of sorting objects to apply to the search.

**For Example:**

\[
    \{
      "field\_id": "string",
      "order": "ASCENDING\_NULLS\_LAST" #required for each object.
    }
  ]
For more information, please refer to [Rapid7 - Insight IDR Documentation](https://docs.rapid7.com/insightidr/api/alert-triage/#tag/Alerts/operation/searchAlerts) |
## Example Output ```json theme={"dark"} { "rrns": [ "string" ], "alerts": [ { "rrn": "string", "version": 0, "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z", "alerted_at": "2019-08-24T14:15:22Z", "ingested_at": "2019-08-24T14:15:22Z", "external_source": "string", "external_id": "string", "organization": { "id": "string", "name": "string", "region": "string", "product_token": "string", "customer_id": "string", "customer_name": "string", "customer_code": "string", "customer_group": "string", "flags": [ "string" ] }, "title": "string", "type": "string", "rule": { "rrn": "string", "name": "string", "mitre_tcodes": [ "string" ], "version_rrn": "string" }, "rule_matching_keys": [ { "key": "string", "values": [ "string" ] } ], "rule_keys_of_interest": [ { "key": "string", "values": [ "string" ] } ], "responsibility": "UNMAPPED", "monitored": true, "assignee": { "at": "2019-08-24T14:15:22Z", "id": "string", "email": "string", "first_name": "string", "last_name": "string" }, "priority": "UNMAPPED", "status": "UNMAPPED", "status_transitions": { "seconds_to_first_investigating": 0, "seconds_to_first_closed": 0, "first_closed_at": "2019-08-24T14:15:22Z" }, "disposition": "UNMAPPED", "investigation_rrn": "string", "tags": [ "string" ], "permissions": { "canEdit": true }, "fields": [ { "id": "string", "values": [ "string" ] } ], "analytics": { "analytics_is_novel": true, "analytics_novel_score": 0.1, "analytics_cluster_malicious": 0.1, "analytics_cluster_testing": 0.1, "analytics_pac": "string" }, "due_date": "2019-08-24T14:15:22Z", "first_closed_at": "2019-08-24T14:15:22Z", "log_details": [ { "log_id": "string", "logset_id": "string", "log_timestamp": 0, "log_entry_id": "string" } ], "ai_suggested_disposition": "UNMAPPED", "prediction_metadata": { "property1": {}, "property2": {} }, "prediction_data": { "property1": {}, "property2": {} } } ], "metadata": { "index": 0, "size": 0, "items_in_index": 0, "total_items": 0, "is_last_index": true }, "aggregates": [ { "name": "string", "type": "BUCKET", "value": {}, "field_ids": [ "string" ], "buckets": [ { "keys": [ [ "string" ] ], "count": 0 } ] } ], "region_failures": [ { "region": "string", "message": "string" } ] } ``` ## Workflow Library Example [Search Alerts with Rapid7 Insightidr and Send Results Via Email](https://library.blinkops.com/workflows/search-alerts-with-rapid7-insightidr-and-send-results-via-email)
Workflow Library Preview this Workflow on desktop