External DocumentationTo learn more, visit the ZeroFox documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Alert Type | Select the types of alerts to return. |
| Limit | The maximum number of alerts to return per page. Values can range from 0 to 100. |
| Max Timestamp | The date and time to return alerts created until. |
| Min Timestamp | The date and time to return alerts created from. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Risk Rating | Select the risk rating of the alerts to return. |
| Status | Select the status of the alerts to return. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Account | The unique ID of the social network account to filter the alerts by. |
| Alert IDs | A comma-separated list of the IDs of the alerts to return. |
| Assignee | The name of the user the alerts are assigned to. |
| Entity ID | The ID of the protected ZeroFox entity. |
| Entity Search | A substring of the protected entity to filter the alerts by. |
| Entity Term ID | The ID of the protected ZeroFox entity term. |
| Escalated | Select whether to return only escalated alerts or only non-escalated alerts. Leave empty to return both. |
| Last Modified | The number of seconds since the alerts were last modified. |
| Network | The names of the networks to filter the alerts by. |
| Offset | The number of alerts to skip before starting to return results. |
| Page IDs | A comma-separated list of the IDs of the ZeroFox pages to filter the alerts by. |
| Page URL | The URL of the website or social media content that triggered the alerts. |
| Perpetrator Search | A substring of the perpetrator’s username or display name to filter the alerts by. |
| Post | The unique ID of the social network post to filter the alerts by. |
| Protected Social Object Search | A substring of the username, display name, or entity term name of the protected social object to filter the alerts by. |
| Rule IDs | A comma-separated list of the IDs of the ZeroFox rules to filter the alerts by. |
| Rule Names | A comma-separated list of the names of the ZeroFox rules to filter the alerts by. |
| Sort Direction | Select the direction to sort the alerts by. |
| Sort Field | Select the field to sort the alerts by. |
| Tags | A comma-separated list of tags. Returns alerts that have at least one of the tags. |
Example Output
{
"count": 10,
"next": null,
"previous": null,
"page_size": 10,
"num_pages": 1,
"alerts": [
{
"alert_type": "search query",
"logs": [
{
"id": 390795944,
"timestamp": "2023-06-01T07:07:58+00:00",
"actor": "",
"subject": "",
"action": "open"
}
],
"offending_content_url": "https://cloud.zerofox.com/intelligence/advanced_dark_web/35803",
"asset_term": null,
"assignee": "",
"entity": {
"id": 560648,
"name": "Virginia Potts",
"image": "https://cdn.zerofox.com/media/entityimages/66bd7e83-1fd.jpg",
"labels": [
{
"id": 1639880,
"name": "Stark"
}
],
"entity_group": {
"id": 4636,
"name": "Default"
}
},
"entity_term": null,
"content_created_at": "2023-06-01T06:55:20+00:00",
"id": 224850127,
"severity": 4,
"perpetrator": {
"name": "Akira Ransomware: Lewis Young Robertson & Burningham",
"display_name": "Akira Ransomware: Lewis Young Robertson & Burningham",
"id": 424158735,
"url": "https://cloud.zerofox.com/intelligence/advanced_dark_web/35803",
"content": "On June 01, 2023, ZeroFox observed an update on the Akira Ransomware leak site targeting Lewis Young Robertson & Burningham, a U.S.-based firm that provide financial advice and consultant to local governments. ZeroFox has detected close to 100 victims of ransomware and digital extortion in the financial services sector in the past year, more than 40 percent of which are in the U.S.-Canada region.",
"type": "page",
"timestamp": "2023-06-01T06:55:20+00:00",
"network": "advanced_dark_web"
},
"rule_group_id": 1775,
"asset": {
"id": 560648,
"name": "Virginia Potts",
"image": "https://cdn.zerofox.com/media/entityimages/66bd7e83-1fd.jpg",
"labels": [
{
"id": 1639880,
"name": "Stark"
}
],
"entity_group": {
"id": 4636,
"name": "Default"
}
},
"entered_by": "",
"metadata": "",
"status": "Open",
"timestamp": "2023-06-01T07:07:58+00:00",
"rule_name": "Advanced Dark Web",
"last_modified": "2023-06-01T07:07:58Z",
"protected_locations": null,
"darkweb_term": null,
"business_network": null,
"reviewed": false,
"escalated": false,
"network": "advanced_dark_web",
"protected_social_object": null,
"notes": "",
"reviews": [],
"rule_id": 41785,
"entity_account": null,
"entity_email_receiver_id": null,
"tags": []
}
]
}
Workflow Library Example
List Alerts with Zerofox and Send Results Via Email