Search Alerts action.
External DocumentationTo learn more, visit the Secureworks Taegis XDR documentation.
Parameters
| Parameter | Description |
|---|---|
| Alert IDs | A comma-separated list of the alert IDs to retrieve. Can be obtained using the Search Alerts action.For Example: alert://priv:stolen-user-credentials:11063:1630602244467:79015c9a-8d22-5c4e-a199-58afc0599aa5 |
Example Output
{
"data": {
"alertsServiceRetrieveAlertsById": {
"status": "",
"reason": "",
"search_id": "",
"alerts": {
"total_results": 0,
"first_offset": 0,
"last_offset": 0,
"next_offset": 0,
"previous_offset": 0,
"total_parts": 0,
"part": 0,
"group_by": [
{
"keys": [
{
"key": "",
"value": ""
}
],
"value": 0
}
],
"list": [
{
"id": "",
"group_key": "",
"tenant_id": "",
"parent_tenant_id": "",
"status": "",
"resolution_reason": "",
"suppressed": false,
"suppression_rules": [
{
"id": "",
"version": ""
}
],
"alerting_rules": [
{
"id": "",
"version": ""
}
],
"tags": [
""
],
"sensor_types": [
""
],
"attack_technique_ids": [
""
],
"threat_score": 0,
"investigation_ids": [
{
"id": "",
"GenesisAlertsFlag": false
}
],
"entities": {
"entities": [
""
],
"relationships": [
{
"from_entity": "",
"relationship": "",
"to_entity": ""
}
]
},
"metadata": {
"title": "",
"full_title": "",
"description": "",
"severity": 0,
"confidence": 0,
"origin": "",
"engine": {
"name": "",
"version": ""
},
"creator": {
"detector": {
"detector_id": "",
"detector_name": "",
"version": ""
},
"rule": {
"rule_id": "",
"version": ""
}
},
"created_at": {
"seconds": 0,
"nanos": 0
},
"updated_at": {
"seconds": 0,
"nanos": 0
},
"first_seen_at": {
"seconds": 0,
"nanos": 0
},
"began_at": {
"seconds": 0,
"nanos": 0
},
"ended_at": {
"seconds": 0,
"nanos": 0
}
}
}
]
}
}
}
}
Workflow Library Example
Get Alerts with Secureworks Taegis Xdr and Send Results Via Email