> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Alert

Get an alert by ID using the Unified Alert Management GraphQL API.

## Parameters

| Parameter | Description |
| - | - |
| Alert ID | The ID of the alert to retrieve. |

## Example Output

```json theme={"dark"}
{
	"data": {
		"alert": {
			"id": "01a03a4e-0a7e-7358-b8d3-a799d94cd680",
			"externalId": "98da58d9-5feb-4f37-8f4a-95f76e32131c",
			"name": "Phishing",
			"description": "A message containing a malicious URL was delivered to a user mailbox.",
			"severity": "HIGH",
			"status": "NEW",
			"classification": "PHISHING",
			"analystVerdict": "UNDEFINED",
			"detectedAt": "2026-01-01T15:56:21.000Z",
			"primaryIndicatorType": "url - https://malicious.example.com/login",
			"selfLink": "https://usea1-example.sentinelone.net/incidents/unified-alerts?alertId=01a03a4e-0a7e-7358-b8d3-a799d94cd680",
			"detectionSource": {
				"product": "Proofpoint",
				"vendor": "Proofpoint"
			},
			"analytics": null,
			"assets": [
				{
					"name": "john.doe@example.com",
					"assetTypeClassifier": "User",
					"agentUuid": null
				}
			],
			"detectionTime": {
				"asset": null,
				"attacker": null,
				"targetUser": {
					"name": "John Doe",
					"domain": "example.com",
					"emailAddress": "john.doe@example.com"
				},
				"cloud": null
			},
			"process": null,
			"observables": [],
			"indicators": [
				{
					"type": "url - https://malicious.example.com/login",
					"observables": [
						{
							"name": "threat url",
							"type": "URL_STRING",
							"typeName": "URL String",
							"value": "https://malicious.example.com/login"
						}
					],
					"attacks": null
				}
			],
			"rawData": {
				"raw_data": "{\"threatsInfoMap\": [{\"threatType\": \"url\", \"threat\": \"https://malicious.example.com/login\"}]}"
			}
		}
	}
}
```