External DocumentationTo learn more, visit the Vega documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Alert IDs | A comma-separated list of alert IDs to filter by. |
| Alert Names | A comma-separated list of alert names to filter by. |
| Alert Severities | Select the alert severities to filter by. |
| Alert Verdicts | Select the alert verdicts to filter by. |
| Data Source Names | A comma-separated list of data source names to filter by. |
| Detection IDs | A comma-separated list of detection IDs to filter by. |
| Has Related Incidents | Select to filter alerts by whether they are linked to at least one incident. Note: true returns only alerts linked to incidents, false returns only unlinked alerts, and omitting it returns both. |
| Limit | The maximum number of results to return per page. The default is 100. |
| Offset | The number of results to skip for pagination. |
| Origin Type | Select the lifecycle state of the detection that produced the alerts to filter by. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Statuses | Select the statuses to filter by. |
Advanced Parameters
| Parameter | Description |
|---|---|
| From | The start date and time to filter results by creation time. |
| To | The end date and time to filter results by creation time. |
| Updated From | The start date and time to filter results by last updated time. |
| Updated To | The end date and time to filter results by last updated time. |
Example Output
{
"data": {
"getAlerts": {
"alerts": [
{
"id": "<string>",
"vegaAlertId": "<string>",
"detectionId": "<string>",
"name": "<string>",
"severity": "LOW",
"status": "OPEN",
"assignees": [
{
"userId": "<string>",
"displayName": "<string>",
"email": "<string>"
}
],
"dataSources": [
"<string>"
],
"createdAt": "2024-01-15T09:30:00Z",
"updatedAt": "2024-01-15T09:30:00Z",
"relatedIncidents": [
{
"incidentId": "<string>",
"name": "<string>"
}
],
"detectionSource": "<string>",
"detectionDescription": "<string>",
"detectionQuery": "<string>",
"isTestMode": true,
"verdict": "NA",
"comments": [
{
"text": "<string>",
"addedBy": "<string>",
"addedAt": "2024-01-15T09:30:00Z"
}
],
"description": "<string>",
"assignee": {
"userId": "<string>",
"displayName": "<string>",
"email": "<string>"
},
"mitre": {
"mitreTactics": [
"<string>"
],
"mitreTechniques": [
"<string>"
]
},
"eventCount": 123,
"verdictReasoning": "<string>",
"dedupCount": 123
}
],
"total": 123,
"limit": 123,
"offset": 123,
"error": {
"code": "<string>",
"message": "<string>"
}
}
}
}
Workflow Library Example
List Alerts with Vega and Send Results Via Email