Skip to main content
Retrieve a list of alerts. Note: By default, alerts from the last 30 days are returned. Use the filtering parameters to modify the date range.
External DocumentationTo learn more, visit the Vega documentation.

​
Basic Parameters

ParameterDescription
Alert IDsA comma-separated list of alert IDs to filter by.
Alert NamesA comma-separated list of alert names to filter by.
Alert SeveritiesSelect the alert severities to filter by.
Alert VerdictsSelect the alert verdicts to filter by.
Data Source NamesA comma-separated list of data source names to filter by.
Detection IDsA comma-separated list of detection IDs to filter by.
Has Related IncidentsSelect to filter alerts by whether they are linked to at least one incident.

Note: true returns only alerts linked to incidents, false returns only unlinked alerts, and omitting it returns both.
LimitThe maximum number of results to return per page. The default is 100.
OffsetThe number of results to skip for pagination.
Origin TypeSelect the lifecycle state of the detection that produced the alerts to filter by.
Return All PagesAutomatically fetch all resources, page by page.
StatusesSelect the statuses to filter by.

​
Advanced Parameters

ParameterDescription
FromThe start date and time to filter results by creation time.
ToThe end date and time to filter results by creation time.
Updated FromThe start date and time to filter results by last updated time.
Updated ToThe end date and time to filter results by last updated time.

​
Example Output

{
	"data": {
		"getAlerts": {
			"alerts": [
				{
					"id": "<string>",
					"vegaAlertId": "<string>",
					"detectionId": "<string>",
					"name": "<string>",
					"severity": "LOW",
					"status": "OPEN",
					"assignees": [
						{
							"userId": "<string>",
							"displayName": "<string>",
							"email": "<string>"
						}
					],
					"dataSources": [
						"<string>"
					],
					"createdAt": "2024-01-15T09:30:00Z",
					"updatedAt": "2024-01-15T09:30:00Z",
					"relatedIncidents": [
						{
							"incidentId": "<string>",
							"name": "<string>"
						}
					],
					"detectionSource": "<string>",
					"detectionDescription": "<string>",
					"detectionQuery": "<string>",
					"isTestMode": true,
					"verdict": "NA",
					"comments": [
						{
							"text": "<string>",
							"addedBy": "<string>",
							"addedAt": "2024-01-15T09:30:00Z"
						}
					],
					"description": "<string>",
					"assignee": {
						"userId": "<string>",
						"displayName": "<string>",
						"email": "<string>"
					},
					"mitre": {
						"mitreTactics": [
							"<string>"
						],
						"mitreTechniques": [
							"<string>"
						]
					},
					"eventCount": 123,
					"verdictReasoning": "<string>",
					"dedupCount": 123
				}
			],
			"total": 123,
			"limit": 123,
			"offset": 123,
			"error": {
				"code": "<string>",
				"message": "<string>"
			}
		}
	}
}

​
Workflow Library Example

List Alerts with Vega and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop