> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# New Alert

Trigger a workflow on every new alert.

**Note:** Up to `500` alerts are emitted per poll, oldest first. If more alerts are created between polls, the remaining alerts are emitted on the following polls.

<Note>
  Workflows with this trigger check for new events **every 5 minutes by default**. You can adjust this interval in the Trigger settings.
</Note>

## Parameters

<div className="integrations-table">
  | Parameter  | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
  | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | CQL Filter | Additional Taegis XDR Query Language (CQL) conditions to filter the alerts by. The conditions are appended to the trigger's own time filter with `AND`.<br /><br />**For Example:** `severity >= 0.6 AND status = 'OPEN'`<br /><br />**Notes:**<br /><br />\* **DO NOT** filter on `created_at`, or use `EARLIEST` or `LATEST`. The trigger manages the time range itself, and a conflicting time filter causes alerts to be missed or repeated.<br /><br />\* **DO NOT** add pipe functions such as `\| sort`, `\| head`, `\| tail` or `\| aggregate`. The trigger relies on its own ascending sort and on the standard response structure.<br /><br />\* **DO NOT** include the `FROM alert` or `WHERE` clauses, they are added by the trigger.<br /><br />\* Use single quotes for string values, as in `status = 'OPEN'`. |
</div>

## Sample Event

```json theme={"dark"}
{
	"id": "alert://priv:event-filter:11063:1630580463490:d30a7171-43a9-5d04-82bf-a25cc0948a8c",
	"group_key": "",
	"tenant_id": "11063",
	"parent_tenant_id": "",
	"status": "OPEN",
	"resolution_reason": "",
	"suppressed": false,
	"suppression_rules": [
		{
			"id": "",
			"version": ""
		}
	],
	"alerting_rules": [
		{
			"id": "",
			"version": ""
		}
	],
	"tags": [
		""
	],
	"sensor_types": [
		"ENDPOINT_CARBON_BLACK"
	],
	"attack_technique_ids": [
		"T1003"
	],
	"threat_score": 0,
	"investigation_ids": [
		{
			"id": "",
			"GenesisAlertsFlag": false
		}
	],
	"entities": {
		"entities": [
			"computerName:OCTO-FILES"
		],
		"relationships": [
			{
				"from_entity": "fileName:rundll32.exe",
				"relationship": "executedOn",
				"to_entity": "sensorHostId:YLdYO3s3ziBynTlgxrBb"
			}
		]
	},
	"metadata": {
		"title": "Memory Dump of the Local Security Authority Subsystem Service",
		"full_title": "",
		"description": "A process event associated with a dump file named after the Local Security Authority Subsystem Service (LSASS) process was identified. This activity may indicate that an adversary is attempting to obtain credentials stored within the memory of this process.\n\nExample:\n>COPY C:\\Users\\>username>\\Appdata\\Local\\Temp\\lsass.dmp C:\\Temp\\lsass.dmp\n\n\n",
		"severity": 0.99,
		"confidence": 1,
		"origin": "",
		"engine": {
			"name": "app:event-filter",
			"version": ""
		},
		"creator": {
			"detector": {
				"detector_id": "app:event-filter",
				"detector_name": "",
				"version": "v0.15.3"
			},
			"rule": {
				"rule_id": "496ad330-7dc2-4009-b431-b792f7095ead",
				"version": "sha1=18f594726b99b47b226a37a2e92ae1cff92d3166-1605731996"
			}
		},
		"created_at": {
			"seconds": 1630580464,
			"nanos": 0
		},
		"updated_at": {
			"seconds": 0,
			"nanos": 0
		},
		"first_seen_at": {
			"seconds": 0,
			"nanos": 0
		},
		"began_at": {
			"seconds": 0,
			"nanos": 0
		},
		"ended_at": {
			"seconds": 0,
			"nanos": 0
		}
	}
}
```