> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Alerts

Get a list of alerts for a given scope.

## Basic Parameters

<div className="integrations-table">
  | Parameter        | Description                                                                                                                                                      |
  | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Alert IDs        | Filter by a list of alert IDs.                                                                                                                                   |
  | Analyst Verdict  | Filter alerts by an analyst verdict.<br />Options:<br />  <pre><code>FALSE\_POSITIVE<br />  SUSPICIOUS<br />  TRUE\_POSITIVE<br />  UNDEFINED<br /></code></pre> |
  | Count Only       | If true, only total number of items will be returned, without any of the actual objects.                                                                         |
  | Created After    | Created after a specified timestamp.                                                                                                                             |
  | Created Before   | Created before a specified timestamp.                                                                                                                            |
  | Cursor           | Cursor position returned by the last request. Use to iterate over more than 1000 items. Example: "YWdlbnRfaWQ6NTgwMjkzODE=".                                     |
  | Incident Status  | Filter alerts by an incident status.<br /> Options:<br />  <pre><code>IN\_PROGRESS<br />  RESOLVED<br />  UNRESOLVED<br /></code></pre>                          |
  | Limit            | Limit number of returned items (1-1000). Example: 10.                                                                                                            |
  | Return All Pages | Automatically fetch all resources, page by page.                                                                                                                 |
  | Sort By          | The column to sort the results by.                                                                                                                               |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter   | Description                                                                       |
  | ----------- | --------------------------------------------------------------------------------- |
  | Account IDs | List of account IDs to filter by. Example: 225494730938493804,225494730938493915. |
</div>

## Example Output

```json theme={"dark"}
{
  "data": [
    {
      "agentDetectionInfo": {
        "accountId": "<string>",
        "machineType": "<string>",
        "name": "<string>",
        "osFamily": "<string>",
        "osName": "<string>",
        "osRevision": "<string>",
        "siteId": "<string>",
        "uuid": "<string>",
        "version": "<string>"
      },
      "agentRealtimeInfo": {
        "id": "<string>",
        "infected": false,
        "isActive": false,
        "isDecommissioned": true,
        "machineType": "<string>",
        "name": "<string>",
        "os": "<string>",
        "uuid": "<string>"
      },
      "alertInfo": {
        "alertId": "<string>",
        "analystVerdict": "<string>",
        "createdAt": "2025-01-01T15:56:21.535999Z",
        "dnsRequest": null,
        "dnsResponse": null,
        "dstIp": null,
        "dstPort": null,
        "dvEventId": "<string>",
        "eventType": "<string>",
        "hitType": "<string>",
        "incidentStatus": "<string>",
        "indicatorCategory": null,
        "indicatorDescription": null,
        "indicatorName": null,
        "isEdr": true,
        "loginAccountDomain": "<string>",
        "loginAccountSid": "<string>",
        "loginIsAdministratorEquivalent": "<string>",
        "loginIsSuccessful": "<string>",
        "loginType": "<string>",
        "loginsUserName": "<string>",
        "modulePath": null,
        "moduleSha1": null,
        "netEventDirection": null,
        "registryKeyPath": null,
        "registryOldValue": null,
        "registryOldValueType": null,
        "registryPath": null,
        "registryValue": null,
        "reportedAt": "2025-01-01T15:56:21.535999Z",
        "source": "<string>",
        "srcIp": null,
        "srcMachineIp": "<string>",
        "srcPort": null,
        "tiIndicatorComparisonMethod": null,
        "tiIndicatorSource": null,
        "tiIndicatorType": null,
        "tiIndicatorValue": null,
        "updatedAt": "2025-01-01T15:56:21.535999Z",
      },
      "containerInfo": {
        "id": null,
        "image": null,
        "labels": null,
        "name": null
      },
      "kubernetesInfo": {
        "cluster": null,
        "controllerKind": null,
        "controllerLabels": null,
        "controllerName": null,
        "namespace": null,
        "namespaceLabels": null,
        "node": null,
        "pod": null,
        "podLabels": null
      },
      "ruleInfo": {
        "description": null,
        "id": "<string>",
        "name": "<string>",
        "queryLang": "<string>",
        "queryType": "<string>",
        "s1ql": "<string>",
        "scopeLevel": "<string>",
        "severity": "<string>",
        "treatAsThreat": "<string>"
      },
      "sourceParentProcessInfo": {
        "commandline": "<string>",
        "effectiveUser": null,
        "fileHashMd5": "<string>",
        "fileHashSha1": "<string>",
        "fileHashSha256": "<string>",
        "filePath": "<string>",
        "fileSignerIdentity": "<string>",
        "integrityLevel": "<string>",
        "loginUser": null,
        "name": "<string>",
        "pid": "<string>",
        "pidStarttime": "2025-04-17T01:15:48.111000Z",
        "realUser": null,
        "storyline": "<string>",
        "subsystem": "<string>",
        "uniqueId": "<string>",
        "user": "<string>"
      },
      "sourceProcessInfo": {
        "commandline": "<string>",
        "effectiveUser": null,
        "fileHashMd5": "<string>",
        "fileHashSha1": "<string>",
        "fileHashSha256": "<string>",
        "filePath": "<string>",
        "fileSignerIdentity": "<string>",
        "integrityLevel": "<string>",
        "loginUser": null,
        "name": "<string>",
        "pid": "<string>",
        "pidStarttime": "2025-04-17T01:15:48.111000Z",
        "realUser": null,
        "storyline": "<string>",
        "subsystem": "<string>",
        "uniqueId": "<string>",
        "user": "<string>"
      },
      "targetProcessInfo": {
        "tgtFileCreatedAt": "2025-01-01T15:56:21.535999Z",
        "tgtFileHashSha1": null,
        "tgtFileHashSha256": null,
        "tgtFileId": null,
        "tgtFileIsSigned": "<string>",
        "tgtFileModifiedAt": "2025-01-01T15:56:21.535999Z",
        "tgtFileOldPath": null,
        "tgtFilePath": null,
        "tgtProcCmdLine": null,
        "tgtProcImagePath": null,
        "tgtProcIntegrityLevel": "<string>",
        "tgtProcName": null,
        "tgtProcPid": null,
        "tgtProcSignedStatus": null,
        "tgtProcStorylineId": null,
        "tgtProcUid": null,
        "tgtProcessStartTime": "2025-04-17T01:15:48.111000Z"
      }
    },
    {
      "agentDetectionInfo": {
        "accountId": "<string>",
        "machineType": "<string>",
        "name": "<string>",
        "osFamily": "<string>",
        "osName": "<string>",
        "osRevision": "<string>",
        "siteId": "<string>",
        "uuid": "<string>",
        "version": "<string>"
      },
      "agentRealtimeInfo": {
        "id": "<string>",
        "infected": false,
        "isActive": false,
        "isDecommissioned": true,
        "machineType": "<string>",
        "name": "<string>",
        "os": "<string>",
        "uuid": "<string>"
      },
      "alertInfo": {
        "alertId": "<string>",
        "analystVerdict": "<string>",
        "createdAt": "2025-01-01T15:56:21.535999Z",
        "dnsRequest": null,
        "dnsResponse": null,
        "dstIp": null,
        "dstPort": null,
        "dvEventId": "<string>",
        "eventType": "<string>",
        "hitType": "<string>",
        "incidentStatus": "<string>",
        "indicatorCategory": null,
        "indicatorDescription": null,
        "indicatorName": null,
        "isEdr": true,
        "loginAccountDomain": "<string>",
        "loginAccountSid": "<string>",
        "loginIsAdministratorEquivalent": "<string>",
        "loginIsSuccessful": "<string>",
        "loginType": "<string>",
        "loginsUserName": "<string>",
        "modulePath": null,
        "moduleSha1": null,
        "netEventDirection": null,
        "registryKeyPath": null,
        "registryOldValue": null,
        "registryOldValueType": null,
        "registryPath": null,
        "registryValue": null,
        "reportedAt": "2025-01-01T15:56:21.535999Z",
        "source": "<string>",
        "srcIp": null,
        "srcMachineIp": null,
        "srcPort": null,
        "tiIndicatorComparisonMethod": null,
        "tiIndicatorSource": null,
        "tiIndicatorType": null,
        "tiIndicatorValue": null,
        "updatedAt": "2025-01-01T15:56:21.535999Z",
      },
      "containerInfo": {
        "id": null,
        "image": null,
        "labels": null,
        "name": null
      },
      "kubernetesInfo": {
        "cluster": null,
        "controllerKind": null,
        "controllerLabels": null,
        "controllerName": null,
        "namespace": null,
        "namespaceLabels": null,
        "node": null,
        "pod": null,
        "podLabels": null
      },
      "ruleInfo": {
        "description": null,
        "id": "<string>",
        "name": "<string>",
        "queryLang": "<string>",
        "queryType": "<string>",
        "s1ql": "<string>",
        "scopeLevel": "<string>",
        "severity": "<string>",
        "treatAsThreat": "<string>"
      },
      "sourceParentProcessInfo": {
        "commandline": "<string>",
        "effectiveUser": null,
        "fileHashMd5": "<string>",
        "fileHashSha1": "<string>",
        "fileHashSha256": "<string>",
        "filePath": "<string>",
        "fileSignerIdentity": "<string>",
        "integrityLevel": "<string>",
        "loginUser": null,
        "name": "<string>",
        "pid": "<string>",
        "pidStarttime": "2025-04-17T01:15:48.111000Z",
        "realUser": null,
        "storyline": "<string>",
        "subsystem": "<string>",
        "uniqueId": "<string>",
        "user": "<string>"
      },
      "sourceProcessInfo": {
        "commandline": "<string>",
        "effectiveUser": null,
        "fileHashMd5": "<string>",
        "fileHashSha1": "<string>",
        "fileHashSha256": "<string>",
        "filePath": "<string>",
        "fileSignerIdentity": "<string>",
        "integrityLevel": "<string>",
        "loginUser": null,
        "name": "<string>",
        "pid": "<string>",
        "pidStarttime": "2025-04-17T01:15:48.111000Z",
        "realUser": null,
        "storyline": "<string>",
        "subsystem": "<string>",
        "uniqueId": "<string>",
        "user": "<string>"
      },
      "targetProcessInfo": {
        "tgtFileCreatedAt": "2025-01-01T15:56:21.535999Z",
        "tgtFileHashSha1": null,
        "tgtFileHashSha256": null,
        "tgtFileId": null,
        "tgtFileIsSigned": "<string>",
        "tgtFileModifiedAt": "2025-01-01T15:56:21.535999Z",
        "tgtFileOldPath": null,
        "tgtFilePath": null,
        "tgtProcCmdLine": null,
        "tgtProcImagePath": null,
        "tgtProcIntegrityLevel": "<string>",
        "tgtProcName": null,
        "tgtProcPid": null,
        "tgtProcSignedStatus": null,
        "tgtProcStorylineId": null,
        "tgtProcUid": null,
        "tgtProcessStartTime": "2025-04-17T01:15:48.111000Z"
      }
    }
  ],
  "pagination": {
    "nextCursor": null,
    "totalItems": 23
  }
}
```

## Workflow Library Example

[Get Alerts with Sentinelone and Send Results Via Email](https://library.blinkops.com/workflows/get-alerts-with-sentinelone-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/get-alerts-with-sentinelone-and-send-results-via-email/canvas" />
</div>