> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Alerts

Search alerts using the Taegis XDR Query Language (CQL).

<Note>
  External Documentation

  To learn more, visit the [Secureworks Taegis XDR documentation](https://docs.taegis.secureworks.com/apis/using_alerts_api/#search-alerts).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter              | Description                                                                                                                                                                                                                                                                                                                                       |
  | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | CQL Query              | The Taegis XDR Query Language (CQL) query to search the alerts by. All timestamps are in UTC.<br /><br />**For Example:** `FROM alert WHERE severity >= 0.6 AND status = 'OPEN' EARLIEST=-1d`                                                                                                                                                     |
  | Limit                  | The maximum number of alerts to return. Defaults to `100`.<br /><br />**Note:** Only the first `10000` alerts are reachable with `Limit`, `Offset` and `Return All Pages`. Use `Search ID` to retrieve anything beyond that.                                                                                                                      |
  | Offset                 | The number of alerts to skip before returning results.                                                                                                                                                                                                                                                                                            |
  | Return All Pages       | Automatically fetch all resources, page by page.                                                                                                                                                                                                                                                                                                  |
  | Search ID              | The next page reference returned by a previous search response. Faster and more consistent than `Limit` and `Offset` for large result sets.<br /><br />**Notes:** <br />\* When this parameter is set, `Limit` and `Offset` are ignored.<br />\* When trying to fetch more than `10000` alerts, use `Search ID` to retrieve anything beyond that. |
  | Tenant Service Filters | A comma-separated list of the tenant services to filter the alerts by. The scope includes the tenant set in the connection and its children.                                                                                                                                                                                                      |
</div>

## Example Output

```json theme={"dark"}
{
	"data": {
		"alertsServiceSearch": {
			"status": "",
			"reason": "",
			"search_id": "",
			"alerts": {
				"total_results": 0,
				"first_offset": 0,
				"last_offset": 0,
				"next_offset": 0,
				"previous_offset": 0,
				"total_parts": 0,
				"part": 0,
				"group_by": [
					{
						"keys": [
							{
								"key": "",
								"value": ""
							}
						],
						"value": 0
					}
				],
				"list": [
					{
						"id": "",
						"group_key": "",
						"tenant_id": "",
						"parent_tenant_id": "",
						"status": "",
						"resolution_reason": "",
						"suppressed": false,
						"suppression_rules": [
							{
								"id": "",
								"version": ""
							}
						],
						"alerting_rules": [
							{
								"id": "",
								"version": ""
							}
						],
						"tags": [
							""
						],
						"sensor_types": [
							""
						],
						"attack_technique_ids": [
							""
						],
						"threat_score": 0,
						"investigation_ids": [
							{
								"id": "",
								"GenesisAlertsFlag": false
							}
						],
						"entities": {
							"entities": [
								""
							],
							"relationships": [
								{
									"from_entity": "",
									"relationship": "",
									"to_entity": ""
								}
							]
						},
						"metadata": {
							"title": "",
							"full_title": "",
							"description": "",
							"severity": 0,
							"confidence": 0,
							"origin": "",
							"engine": {
								"name": "",
								"version": ""
							},
							"creator": {
								"detector": {
									"detector_id": "",
									"detector_name": "",
									"version": ""
								},
								"rule": {
									"rule_id": "",
									"version": ""
								}
							},
							"created_at": {
								"seconds": 0,
								"nanos": 0
							},
							"updated_at": {
								"seconds": 0,
								"nanos": 0
							},
							"first_seen_at": {
								"seconds": 0,
								"nanos": 0
							},
							"began_at": {
								"seconds": 0,
								"nanos": 0
							},
							"ended_at": {
								"seconds": 0,
								"nanos": 0
							}
						}
					}
				]
			}
		}
	}
}
```

## Workflow Library Example

[Search Alerts with Secureworks Taegis Xdr and Send Results Via Email](https://library.blinkops.com/workflows/search-alerts-with-secureworks-taegis-xdr-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/search-alerts-with-secureworks-taegis-xdr-and-send-results-via-email/canvas" />
</div>