External DocumentationTo learn more, visit the Secureworks Taegis XDR documentation.
Parameters
| Parameter | Description |
|---|---|
| CQL Query | The Taegis XDR Query Language (CQL) query to search the alerts by. All timestamps are in UTC. For Example: FROM alert WHERE severity >= 0.6 AND status = 'OPEN' EARLIEST=-1d |
| Limit | The maximum number of alerts to return. Defaults to 100.Note: Only the first 10000 alerts are reachable with Limit, Offset and Return All Pages. Use Search ID to retrieve anything beyond that. |
| Offset | The number of alerts to skip before returning results. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Search ID | The next page reference returned by a previous search response. Faster and more consistent than Limit and Offset for large result sets.Notes: * When this parameter is set, Limit and Offset are ignored.* When trying to fetch more than 10000 alerts, use Search ID to retrieve anything beyond that. |
| Tenant Service Filters | A comma-separated list of the tenant services to filter the alerts by. The scope includes the tenant set in the connection and its children. |
Example Output
{
"data": {
"alertsServiceSearch": {
"status": "",
"reason": "",
"search_id": "",
"alerts": {
"total_results": 0,
"first_offset": 0,
"last_offset": 0,
"next_offset": 0,
"previous_offset": 0,
"total_parts": 0,
"part": 0,
"group_by": [
{
"keys": [
{
"key": "",
"value": ""
}
],
"value": 0
}
],
"list": [
{
"id": "",
"group_key": "",
"tenant_id": "",
"parent_tenant_id": "",
"status": "",
"resolution_reason": "",
"suppressed": false,
"suppression_rules": [
{
"id": "",
"version": ""
}
],
"alerting_rules": [
{
"id": "",
"version": ""
}
],
"tags": [
""
],
"sensor_types": [
""
],
"attack_technique_ids": [
""
],
"threat_score": 0,
"investigation_ids": [
{
"id": "",
"GenesisAlertsFlag": false
}
],
"entities": {
"entities": [
""
],
"relationships": [
{
"from_entity": "",
"relationship": "",
"to_entity": ""
}
]
},
"metadata": {
"title": "",
"full_title": "",
"description": "",
"severity": 0,
"confidence": 0,
"origin": "",
"engine": {
"name": "",
"version": ""
},
"creator": {
"detector": {
"detector_id": "",
"detector_name": "",
"version": ""
},
"rule": {
"rule_id": "",
"version": ""
}
},
"created_at": {
"seconds": 0,
"nanos": 0
},
"updated_at": {
"seconds": 0,
"nanos": 0
},
"first_seen_at": {
"seconds": 0,
"nanos": 0
},
"began_at": {
"seconds": 0,
"nanos": 0
},
"ended_at": {
"seconds": 0,
"nanos": 0
}
}
}
]
}
}
}
}
Workflow Library Example
Search Alerts with Secureworks Taegis Xdr and Send Results Via Email