> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# New Alert

Triggers a workflow on every new alert detected in Trellix Helix.

**Endpoint**: `/v3/alerts`

> [!NOTE]
>
> Workflows with this trigger check for new events **every 5 minutes by default**. You can adjust this interval in the Trigger settings.

## Parameters

| Parameter | Description |
| - | - |
| Confidence | The confidence level to filter the alerts by. |
| Risk | The risk levels to filter the alerts by. |
| Severity | The severity level to filter the alerts by. |
| State | The state to filter the alerts by. |

## Sample Event

```json theme={"dark"}
{
	"primary_id": 160037,
	"alert_type": {
		"id": 1084,
		"created_at": "2020-11-04T22:10:59.778556Z",
		"updated_at": "2026-06-08T13:25:08.044218Z",
		"type_id": "13841-2389e1da49e0",
		"category": "Host",
		"detail_fields": [
			"hostname",
			"eventid",
			"username"
		],
		"correlation_fields": [
			{
				"corr_mql": "class:alerts rawmsg:{}",
				"corr_name": "Correlate by hostname",
				"corr_fields": [
					"hostname",
					"srchost"
				],
				"ignore_vals": [
					"system"
				],
				"relative_time": 240
			}
		],
		"is_default": false,
		"is_internal": true,
		"name": "Windows Process",
		"summary_fields": [
			"process",
			"username"
		],
		"source": [
			"hostname"
		],
		"destination": [
			"eventid",
			"category"
		],
		"created_by": "abd5feae-84fc-41e9-be61-336ec358c89a",
		"updated_by": "abd5feae-84fc-41e9-be61-336ec358c89a"
	},
	"assigned_to": null,
	"context": null,
	"created_by": {
		"id": "abd5feae-84c89a",
		"avatar": "https://secure.gravatar.com/avatar/8267ad472c",
		"name": "System User",
		"username": "system_user",
		"primary_email": "no.reply@fireeye.com"
	},
	"events_count": 1,
	"notes_count": 0,
	"queues": [
		"Default Queue"
	],
	"source_url": "https://apps.fireeye.com/helix/id/363/alerts/16008037",
	"updated_by": {
		"id": "abd5feae358c89a",
		"avatar": "https://secure.gravatar.com/avatar/8267ad472c",
		"name": "System User",
		"username": "system_user",
		"primary_email": "no.reply@fireeye.com"
	},
	"organization": "363",
	"risk_score": 50,
	"life_span": "32d 16h 55m 03s",
	"last_event_at": "2026-10-01 17:19:46Z",
	"first_event_at": "2026-10-01 17:19:46Z",
	"derived_risk": "Low",
	"hx_device_versions": [
		"10.0.22631"
	],
	"intel_source": [],
	"created_at": "2026-10-01T17:20:26.367329Z",
	"updated_at": "2026-10-01T17:20:30.407221Z",
	"id": 1607,
	"alert_threat": "Unknown",
	"alert_type_details": {
		"detail": {
			"msg": "a new process has been created.",
			"pid": 196,
			"class": "ms_windows_event",
			"source": "microsoft-windows-security-auditing",
			"eventid": "46",
			"process": "c:\\windows\\system32\\rundll32.exe",
			"category": "process creation",
			"deviceid": "8632b3",
			"eventlog": "security",
			"hostname": "host.example.com",
			"pprocess": "c:\\program files\\...\\outlook.exe",
			"severity": "info",
			"threadid": "296",
			"username": "user1",
			"eventtype": "audit_success",
			"meta_cbid": 88888,
			"metaclass": "windows",
			"callingdomain": "example",
			"severityvalue": 2
		},
		"source": "host.example.com",
		"summary": {
			"process": "c:\\windows\\system32\\rundll32.exe",
			"username": "user1"
		},
		"properties": {
			"class": "ms_windows_event",
			"deviceid": "867932b3",
			"meta_cbid": 888888,
			"customer_id": "33"
		},
		"destination": "4688"
	},
	"assigned_at": null,
	"classification": 40,
	"closed_reason": "",
	"closed_state": "Unknown",
	"confidence": "Medium",
	"description": "This rule looks for a Microsoft Office process launching a suspicious child process.",
	"distinguisher_key": "host.example.com",
	"distinguishers": {
		"hostname": "host.example.com"
	},
	"emailed_at": 739890,
	"events_threshold": 1,
	"external_id": "",
	"external_ips": [],
	"external_ips_count": 0,
	"info_links": [
		"System Binary Proxy Execution, Technique T1218"
	],
	"internal_ips": [],
	"internal_ips_count": 0,
	"is_suppressed": false,
	"is_threat": false,
	"is_tuned": false,
	"kill_chain": [
		"5 - Installation"
	],
	"last_sync_ms": 1790875224056,
	"message": "WINDOWS METHODOLOGY [Office Suspicious Child Process]",
	"mitre_ids": [
		"T1218",
		"T1059"
	],
	"metaclasses": {
		"windows": 1
	},
	"mongo_id": "6abe96581012d34",
	"origin_id": "map_rule",
	"products": {},
	"risk": "Medium",
	"risk_order": 2,
	"search": "metaclass:windows eventid=4688 process:[rundll32.exe]",
	"seconds_threshold": 60,
	"severity": "Medium",
	"source_revision": 0,
	"state": "Open",
	"tags": [
		"windows",
		"methodology",
		"office"
	],
	"threat_changed_at": null,
	"threat_type": 5,
	"trigger_id": "1.1.2497",
	"trigger_revision": 9,
	"tuning_search": "",
	"type": "fireeye_rule",
	"asset_ids": [
		25188129,
		1343975007
	],
	"threat_vector": [
		"endpoint"
	]
}
```