> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Alerts

Retrieve a list of alerts.

## Parameters

| Parameter | Description |
| - | - |
| Confidence | The confidence level to filter the alerts by. |
| Created After | Retrieve only the alerts that were created at or after the given time. |
| Limit | The maximum number of results to return. |
| Offset | The number of results to skip before starting to collect the result set. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Risk | The risk levels to filter the alerts by. |
| Severity | The severity level to filter the alerts by. |
| State | The state to filter the alerts by. |

## Example Output

```json theme={"dark"}
{
	"meta": {
		"count": 1,
		"limit": 1,
		"offset": 0,
		"next": "https://apps.fireeye.com/helix/id/363/api/v3/alerts?limit=1&offset=1",
		"previous": null
	},
	"results": [
		{
			"primary_id": 168037,
			"alert_type": {
				"id": 1084,
				"created_at": "2020-11-04T22:10:59.778556Z",
				"updated_at": "2026-06-08T13:25:08.044218Z",
				"type_id": "135e8-2389e1da49e0",
				"category": "Host",
				"detail_fields": [
					"hostname",
					"eventid",
					"username"
				],
				"correlation_fields": [
					{
						"corr_mql": "class:alerts rawmsg:{}",
						"corr_name": "Correlate by hostname",
						"corr_fields": [
							"hostname",
							"srchost"
						],
						"ignore_vals": [
							"system"
						],
						"relative_time": 240
					}
				],
				"is_default": false,
				"is_internal": true,
				"name": "Windows Process",
				"summary_fields": [
					"process",
					"username"
				],
				"source": [
					"hostname"
				],
				"destination": [
					"eventid",
					"category"
				],
				"created_by": "abd5feae-84fc-41e9-be61-336ec358c89a",
				"updated_by": "abd5feae-84fc-41e9-be61-336ec358c89a"
			},
			"assigned_to": null,
			"context": null,
			"created_by": {
				"id": "abd5feae-84fc-4a",
				"avatar": "https://secure.gravatar.com/avatar/8267ad472c",
				"name": "System User",
				"username": "system_user",
				"primary_email": "no.reply@fireeye.com"
			},
			"events_count": 1,
			"notes_count": 0,
			"queues": [
				"Default Queue"
			],
			"source_url": "https://apps.fireeye.com/helix/id/363/alerts/16008037",
			"updated_by": {
				"id": "abd56ec358c89a",
				"avatar": "https://secure.gravatar.com/avatar/8267ad472c",
				"name": "System User",
				"username": "system_user",
				"primary_email": "no.reply@fireeye.com"
			},
			"organization": "363",
			"risk_score": 50,
			"life_span": "32d 16h 55m 03s",
			"last_event_at": "2026-10-01 17:19:46Z",
			"first_event_at": "2026-10-01 17:19:46Z",
			"derived_risk": "Low",
			"hx_device_versions": [
				"10.0.22631"
			],
			"intel_source": [],
			"created_at": "2026-10-01T17:20:26.367329Z",
			"updated_at": "2026-10-01T17:20:30.407221Z",
			"id": 18037,
			"alert_threat": "Unknown",
			"alert_type_details": {
				"detail": {
					"msg": "a new process has been created.",
					"pid": 176,
					"class": "ms_windows_event",
					"source": "microsoft-windows-security-auditing",
					"eventid": "88",
					"process": "c:\\windows\\system32\\rundll32.exe",
					"category": "process creation",
					"deviceid": "8b3",
					"eventlog": "security",
					"hostname": "host.example.com",
					"pprocess": "c:\\program files\\...\\outlook.exe",
					"severity": "info",
					"threadid": "296",
					"username": "user1",
					"eventtype": "audit_success",
					"meta_cbid": 8888,
					"metaclass": "windows",
					"callingdomain": "example",
					"severityvalue": 2
				},
				"source": "host.example.com",
				"summary": {
					"process": "c:\\windows\\system32\\rundll32.exe",
					"username": "user1"
				},
				"properties": {
					"class": "ms_windows_event",
					"deviceid": "8679",
					"meta_cbid": 8888,
					"customer_id": "363"
				},
				"destination": "4688"
			},
			"assigned_at": null,
			"classification": 40,
			"closed_reason": "",
			"closed_state": "Unknown",
			"confidence": "Medium",
			"description": "This rule looks for a Microsoft Office process launching a suspicious child process.",
			"distinguisher_key": "host.example.com",
			"distinguishers": {
				"hostname": "host.example.com"
			},
			"emailed_at": 739890,
			"events_threshold": 1,
			"external_id": "",
			"external_ips": [],
			"external_ips_count": 0,
			"info_links": [
				"System Binary Proxy Execution, Technique T1218"
			],
			"internal_ips": [],
			"internal_ips_count": 0,
			"is_suppressed": false,
			"is_threat": false,
			"is_tuned": false,
			"kill_chain": [
				"5 - Installation"
			],
			"last_sync_ms": 1790875224056,
			"message": "WINDOWS METHODOLOGY [Office Suspicious Child Process]",
			"mitre_ids": [
				"T1218",
				"T1059"
			],
			"metaclasses": {
				"windows": 1
			},
			"mongo_id": "6abe99b542d34",
			"origin_id": "map_rule",
			"products": {},
			"risk": "Medium",
			"risk_order": 2,
			"search": "metaclass:windows eventid=4688 process:[rundll32.exe]",
			"seconds_threshold": 60,
			"severity": "Medium",
			"source_revision": 0,
			"state": "Open",
			"tags": [
				"windows",
				"methodology",
				"office"
			],
			"threat_changed_at": null,
			"threat_type": 5,
			"trigger_id": "1.1.2497",
			"trigger_revision": 9,
			"tuning_search": "",
			"type": "fireeye_rule",
			"asset_ids": [
				25188129,
				1343975007
			],
			"threat_vector": [
				"endpoint"
			]
		}
	]
}
```