> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Alerts

Retrieve a list of the raw security alerts detected across the managed endpoints.

<Note>
  External Documentation

  To learn more, visit the [Trellix EDR documentation](https://docs.trellix.com/bundle/mvision-endpoint-detection-and-response-product-guide/page/UUID-ab43d037-e7c2-f21e-77b4-2aa76536b351.html).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter        | Description                                                                                                                                                                                                                             |
  | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Filter           | A JSON-encoded string of the filters to apply, based on criteria such as the severity, name, or rank.<br /><br />**For Example:**<br /><pre><code>\{<br />  "severities": \["s0", "s1"],<br />  "scoreRange": \[30]<br />}</code></pre> |
  | From             | The start of the time frame to search.                                                                                                                                                                                                  |
  | Limit            | The maximum number of results to return.                                                                                                                                                                                                |
  | Offset           | The number of results to skip before starting to collect the result set.                                                                                                                                                                |
  | Return All Pages | Automatically fetch all resources, page by page.                                                                                                                                                                                        |
  | Sort             | The field to sort the results by.                                                                                                                                                                                                       |
  | To               | The end of the time frame to search.                                                                                                                                                                                                    |
</div>

## Example Output

```json theme={"dark"}
{
	"type": "alerts",
	"id": "01c0a61a-060a-28e4-002a-7003f431c7aa.fb76269dfabf4fd08385b195064083fa",
	"attributes": {
		"Severity": "s0",
		"Parent_Process_Path": "/usr/bin/bash",
		"Process_Integrity": "0.0",
		"HostInfo": "{ifaces=[{ip=10.26.3.39, mac=00:50:56:AC:80:A3, name=, type=0.0}, {ip=, mac=, name=Primary, type=0.0}], os={build=0.0, desc=Linux, major=6.0, minor=4.0, sp=0-150600.23.22-default}}",
		"Root_Trace_Id": "fee3fc1b-5fc4-4275-b11b-b55f078ae53b",
		"Related_Trace_Id": [
			"56cfd2c2-018a-4aca-aa70-d983dd6a7f0e"
		],
		"Process_Sha256": "81b443c0c5053c0b1124f6ad2474a7e256d9d58ca23d6e533e721a5b90c43479",
		"Hash_Id": "j5bX9WlAb2jI/Clfo47ESA==",
		"Parent_Process_MD5": "6a61aa11781ccf7ee3a31ce111cb73f4",
		"Parents_Trace_Id": [
			"b1ed287d-6c28-4762-85a3-7643e93e5490",
			"e9cacc53-6100-4a0f-a1dd-a874dcad91b5",
			"fee3fc1b-5fc4-4275-b11b-b55f078ae53b",
			"00f8900c-911c-4bf8-9a24-111190de3901",
			"7968480a-d3da-4e43-9c8d-7b710af4988f",
			"96d5fd2e-e69d-4576-89aa-17a7f21bbc05",
			"00000000-0000-0000-0000-000000000000"
		],
		"Detection_Tags": [
			"@ATA.DefenseEvasion",
			"@ATE.T1070.004",
			"@MSI._process_file_remove"
		],
		"Process_Path": "/usr/lib/cron/run-crons",
		"HX_Agent_Id": "3t8gXjwtzaebzEOsqzdTrP",
		"CommandLine": "/usr/lib/cron/run-crons",
		"P_Parent_TraceId": "e9cacc53-6100-4a0f-a1dd-a874dcad91b5",
		"Rank": 30,
		"Pid": 23502,
		"Parent_Process_Name": "bash",
		"Host_Name": "82ZSUSE15SP6",
		"DetectionDate": "2025-11-10T05:50:41.464+00:00",
		"ProcessName": "run-crons",
		"Parent_Process_Sha256": "5148d2d56a9635b925392e4943e2da9a38fcd29e722d3b598e0d656a4fecc19f",
		"Trace_Id": "a533a1d0-8a06-4a79-8e40-0e6ff3a0088c",
		"MAGUID": "1EE2B999-5AA0-F011-87C6-005056AC80A3",
		"Version": "undefined",
		"Parent_Process_CmdLine": "/bin/sh -c test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons >/dev/null 2>&1",
		"Process_Md5": "878e7ab69c2245e097807ee5c8fbaf50",
		"Event_Date": "2025-11-10T05:45:01.000Z",
		"Host_OS": "linux",
		"Artifact": "Threat",
		"Parent_Trace_Id": "b1ed287d-6c28-4762-85a3-7643e93e5490",
		"Score": 30,
		"User": {
			"domain": "",
			"name": "root"
		},
		"Activity": "Threat Detected",
		"RuleId": "_process_file_remove"
	}
}
```

## Workflow Library Example

[List Alerts with Trellix Edr and Send Results Via Email](https://library.blinkops.com/workflows/list-alerts-with-trellix-edr-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/list-alerts-with-trellix-edr-and-send-results-via-email/canvas" />
</div>