List Alerts V2 - GET

Returns a paginated list of alerts from the Prisma Cloud platform.

Data in the response object does not include alert rules.

Also, in the response object:

• Property riskDetail is deprecated.
• Property items[].resource.cloudServiceName is populated only for alerts whose resources belong to a cloud service.

Rate Limits

The following rate limits apply:

• Request rate limit: 2/sec
• Burst limit: 10/sec

Query Parameters

timeType string required

Possible values: [relative]

Time Type

timeAmount string required

Number of timeUnits

timeUnit string required

Possible values: [minute, hour, day, week, month, year]

Time Unit

detailed boolean required

true = Return detailed alert data.

fields string

Array of specific fields to return. Allowed fields: alert.id, alert.status, alert.time, cloud.accountId, cloud.account, cloud.region, resource.id, resource.name, policy.name, policy.type, policy.severity

sortBy string
Response object property by which to sort response list. The valid values are in the response object attribute sortAllowedColumns. The format is property:asc for ascending and property:desc for descending sort
Example: sortBy=id:desc&sortBy=firstseen:asc,lastseen:desc
limit number

The maximum number of items that will be returned in one response. The maximum cannot exceed 10,000. The default is 10,000.

pageToken string

Token that identifies the required page of data. When there are multiple pages of data in the response, set pageToken to the nextPageToken value from the previous API response to retrieve the next page of data.

alert.id string

Alert ID

alert.status string

Possible values: [open, dismissed, snoozed, resolved, pending_resolution]

Alert status

cloud.account string

Cloud account

cloud.accountId string

Cloud account Id

account.group string

Account group

cloud.type string

Cloud type

cloud.region string

Cloud region

cloud.service string

Cloud service

policy.id string

Policy ID

policy.name string

Policy name

policy.severity string

Possible values: [critical, high, medium, low, informational]

Policy severity

policy.label string

Policy label

policy.type string

Possible values: [config, network, audit_event]

Policy type

policy.complianceStandard string

Policy compliance standard name

policy.complianceRequirement string

Policy compliance requirement name

policy.complianceSection string

Policy compliance section ID

policy.remediable string

Possible values: [true, false]

Policy is remediable

alertRule.name string

Alert rule name

resource.id string

Resource ID

resource.name string

Resource name

resource.type string

Resource TYPE

Responses

• 200
• 400
• 429

---

successful operation

*/*

Schema

Example (from schema)

---

Schema

dynamicColumns string[]
infoMsg string
items object[]
Array [
alertAdditionalInfo object
property name* string
alertAttribution object
Model for AlertAttribution
attributionEventList object[]
Array [
event string
Event
event_ts int64
Event Timestamp
username string
Username
]
resourceCreatedBy string
Resource Created By
resourceCreatedOn int64
Resource Created On
alertCount int64
alertRules object[]
Array [
alertRuleNotificationConfig object[]
List of data for notifications to third-party tools
Array [
daysOfWeek object[]
Days of week
Array [
day string
Possible values: [SU, MO, TU, WE, TH, FR, SA]
offset int32
]
detailedReport boolean
Provide csv detailed report
enabled boolean
Scan enabled
frequency string
Possible values: [as_it_happens, daily, weekly, monthly]
id string
Alert rule notification config ID
includeRemediation boolean
Include remediation in detailed report
lastUpdated int64
Last Updated
last_sent_ts int64
Time of last notification in milliseconds
recipients string[]
• For email notifications: List of unique email addresses to notify
• For integrations without notification templates: List of integration ids
• For integrations with notification templates: List of notification template ids
rruleSchedule string
templateId string
Template ID
type string
Possible values: [email, slack, splunk, amazon_sqs, jira, microsoft_teams, webhook, aws_security_hub, google_cscc, service_now, pager_duty, azure_service_bus_queue, demisto, aws_s3, snowflake]
Integration type
withCompression boolean
Compress detailed report
]
allowAutoRemediate boolean
Allow Auto-Remediation
delayNotificationMs int64
Delay notifications by the specified milliseconds
description string
Rule/Scan description
enabled boolean
Rule/Scan is enabled
name string required
Rule/Scan name
notifyOnDismissed boolean
include dismissed alerts in notification
notifyOnOpen boolean
include open alerts in notification
notifyOnResolved boolean
include resolved alerts in notification
notifyOnSnoozed boolean
include snoozed alerts in notification
policies string[]
List of specific policies to scan
policyLabels string[]
Policy labels
policyScanConfigId string
Policy Scan Config ID
scanAll boolean
Scan all policies
target object
Model for Target Filter
accountGroups string[]
List of Account group(s)
alertRulePolicyFilter object
Model for Alert Rule Policy Filter
availablePolicyFilters string[]
List of available Alert Rule Policy Filters
cloud.type string[]
Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]
Cloud Type Filter
policy.complianceStandard string[]
Compliance Standard Filter
policy.label string[]
Policy Label Filter
policy.severity string[]
Policy Severity Filter
excludedAccounts string[]
List of excluded accounts
includedResourceLists object
Model for holding the lists resource list ids by resource list type
computeAccessGroupIds string[]
regions string[]
List of regions for which alerts will be triggered for account groups. Alerts not associated with specific regions will be triggered regardless of listed regions. If no regions are specified, then the alerts will be triggered for all regions.
tags object[]
List of TargetTag models (resource tags) for which alerts should be triggered
Array [
key string
Resource tag target
values string[]
List of value(s) for resource tag key
]
]
alertTime int64
Timestamp when alert was last reopened for resource update, or the same as firstSeen if there are no status changes.
dismissalDuration string
Dismissal Duration
dismissalNote string
Dismissal note
dismissalUntilTs int64
Dismiss until this timestamp
dismissedBy string
Dismissed by
eventOccurred int64
Timestamp when the event occurred. Set only for Audit Event policies.
firstSeen int64
Timestamp of the first policy violation for the alert resource (i.e. the alert creation timestamp)
history object[]
Array [
]
id string
Alert ID
lastSeen int64
Timestamp when alert status was last updated.
lastUpdated int64
Timestamp when alert was last updated. Updates include but are not limited to resource updates, policy updates, alert rule updates, and alert status changes.
metadata object
Raw JSON metadata for the alert
policy object
Model for Policy
cloudType string
Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]
Cloud type (Required for config policies). Not case-sensitive. Default is ALL.
complianceMetadata object[]
List of compliance data. Each item has compliance standard, requirement, and/or section information.
Array [
complianceId string
Compliance Section UUID
customAssigned boolean
policyId string
Policy ID
requirementDescription string
Requirement description
requirementId string
Requirement ID
requirementName string
Requirement name
sectionDescription string
Section name
sectionId string
Section Id
sectionLabel string
Section Label
standardDescription string
Compliance standard description
standardId string
standardName string
Compliance standard name
]
description string
Policy description
enabled boolean
true=enabled. false=disabled.
findingTypes string[]
Finding Type
labels string[]
Labels
name string required
Policy name
policyType string required
Possible values: [config, network, audit_event, anomaly, data, iam, workload_vulnerability, workload_incident, waas_event, attack_path]
Policy type. Policy type anomaly is read-only.
recommendation string
Remediation recommendation
remediation object
Model for Remediation
actions object[]
Policy Action
Array [
operation string
payload string
]
cliScriptTemplate string
CLI Script Template
description string
Description
rule object
Model for Rule
criteria string required
Saved search ID that defines the rule criteria.
dataCriteria object
Criteria for Rule
classificationResult string
Data policy. Required for DLP rule criteria.
exposure string
Possible values: [private, public, conditional]
File exposure
extension string[]
File extensions
name string required
Name
parameters object required
Parameters (e.g. {"savedSearch": "true"})
property name* string
type string required
Possible values: [Config, Network, AuditEvent, DLP, IAM, NetworkConfig]
Type of rule or RQL query
severity string required
Possible values: [high, medium, low]
Severity
policyId string
Policy ID
resource object
Model for Cloud Resource
account string
Account
accountId string
Account ID
additionalInfo object
Additional info
array boolean
bigDecimal boolean
bigInteger boolean
binary boolean
boolean boolean
containerNode boolean
double boolean
float boolean
floatingPointNumber boolean
int boolean
integralNumber boolean
long boolean
missingNode boolean
nodeType string
Possible values: [ARRAY, BINARY, BOOLEAN, MISSING, NULL, NUMBER, OBJECT, POJO, STRING]
null boolean
number boolean
object boolean
pojo boolean
short boolean
textual boolean
valueNode boolean
cloudAccountGroups string[]
Cloud account groups
cloudType string
Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]
Cloud type
id string
Id
name string
Name
region string
Region name
regionId string
Region API identifier
resourceConfigJsonAvailable boolean
resourceDetailsAvailable boolean
resourceTags object
Resource tags
property name* string
rrn string
RRN
unifiedAssetId string
url string
URL
riskDetail object
Model for Risk Detail
policyScores object[]
Array [
cloudType string
Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]
Cloud type (Required for config policies). Not case-sensitive. Default is ALL.
complianceMetadata object[]
List of compliance data. Each item has compliance standard, requirement, and/or section information.
Array [
complianceId string
Compliance Section UUID
customAssigned boolean
policyId string
Policy ID
requirementDescription string
Requirement description
requirementId string
Requirement ID
requirementName string
Requirement name
sectionDescription string
Section name
sectionId string
Section Id
sectionLabel string
Section Label
standardDescription string
Compliance standard description
standardId string
standardName string
Compliance standard name
]
description string
Policy description
enabled boolean
true=enabled. false=disabled.
findingTypes string[]
Finding Type
labels string[]
Labels
name string required
Policy name
points string
Points
policyType string required
Possible values: [config, network, audit_event, anomaly, data, iam, workload_vulnerability, workload_incident, waas_event, attack_path]
Policy type. Policy type anomaly is read-only.
recommendation string
Remediation recommendation
remediation object
Model for Remediation
actions object[]
Policy Action
Array [
operation string
payload string
]
cliScriptTemplate string
CLI Script Template
description string
Description
riskScore object
Model for Score
maxScore int64
Max Score
score int64
Score
rule object required
Model for Rule
criteria string required
Saved search ID that defines the rule criteria.
dataCriteria object
Criteria for Rule
classificationResult string
Data policy. Required for DLP rule criteria.
exposure string
Possible values: [private, public, conditional]
File exposure
extension string[]
File extensions
name string required
Name
parameters object required
Parameters (e.g. {"savedSearch": "true"})
property name* string
type string required
Possible values: [Config, Network, AuditEvent, DLP, IAM, NetworkConfig]
Type of rule or RQL query
severity string required
Possible values: [high, medium, low]
Severity
]
rating string
Rating
riskScore object
Model for Score
maxScore int64
Max Score
score int64
Score
score string
Score
saveSearchId string
Saved Search ID
triggeredBy string
Triggered By
]
nextPageToken string
sortAllowedColumns string[]
totalRows int64

{
  "dynamicColumns": [
    "string"
  ],
  "infoMsg": "string",
  "items": [
    {
      "alertAdditionalInfo": {},
      "alertAttribution": {
        "attributionEventList": [
          {
            "event": "string",
            "event_ts": 0,
            "username": "string"
          }
        ],
        "resourceCreatedBy": "string",
        "resourceCreatedOn": 0
      },
      "alertCount": 0,
      "alertRules": [
        {
          "alertRuleNotificationConfig": [
            {
              "dayOfMonth": 0,
              "daysOfWeek": [
                {
                  "day": "SU",
                  "offset": 0
                }
              ],
              "detailedReport": true,
              "enabled": true,
              "frequency": "as_it_happens",
              "frequencyFromRRule": "string",
              "hourOfDay": 0,
              "id": "string",
              "includeRemediation": true,
              "lastUpdated": 0,
              "last_sent_ts": 0,
              "recipients": [
                "string"
              ],
              "rruleSchedule": "string",
              "templateId": "string",
              "timezone": "string",
              "type": "email",
              "withCompression": true
            }
          ],
          "allowAutoRemediate": true,
          "delayNotificationMs": 0,
          "description": "string",
          "enabled": true,
          "lastModifiedBy": "string",
          "lastModifiedOn": 0,
          "name": "string",
          "notifyOnDismissed": true,
          "notifyOnOpen": true,
          "notifyOnResolved": true,
          "notifyOnSnoozed": true,
          "policies": [
            "string"
          ],
          "policyLabels": [
            "string"
          ],
          "policyScanConfigId": "string",
          "scanAll": true,
          "target": {
            "accountGroups": [
              "string"
            ],
            "alertRulePolicyFilter": {
              "availablePolicyFilters": [
                "string"
              ],
              "cloud.type": [
                "ALL"
              ],
              "policy.complianceStandard": [
                "string"
              ],
              "policy.label": [
                "string"
              ],
              "policy.severity": [
                "string"
              ]
            },
            "excludedAccounts": [
              "string"
            ],
            "includedResourceLists": {
              "computeAccessGroupIds": [
                "string"
              ]
            },
            "regions": [
              "string"
            ],
            "tags": [
              {
                "key": "string",
                "values": [
                  "string"
                ]
              }
            ]
          }
        }
      ],
      "alertTime": 0,
      "dismissalDuration": "string",
      "dismissalNote": "string",
      "dismissalUntilTs": 0,
      "dismissedBy": "string",
      "eventOccurred": 0,
      "firstSeen": 0,
      "history": [
        {
          "reason": "string",
          "status": "OPEN"
        }
      ],
      "id": "string",
      "lastSeen": 0,
      "lastUpdated": 0,
      "metadata": {},
      "policy": {
        "cloudType": "ALL",
        "complianceMetadata": [
          {
            "complianceId": "string",
            "customAssigned": true,
            "policyId": "string",
            "requirementDescription": "string",
            "requirementId": "string",
            "requirementName": "string",
            "sectionDescription": "string",
            "sectionId": "string",
            "sectionLabel": "string",
            "standardDescription": "string",
            "standardId": "string",
            "standardName": "string"
          }
        ],
        "createdBy": "string",
        "createdOn": 0,
        "deleted": true,
        "description": "string",
        "enabled": true,
        "findingTypes": [
          "string"
        ],
        "labels": [
          "string"
        ],
        "lastModifiedBy": "string",
        "lastModifiedOn": 0,
        "name": "string",
        "overridden": true,
        "policyId": "string",
        "policySubTypes": [
          "run"
        ],
        "policyType": "config",
        "policyUpi": "string",
        "recommendation": "string",
        "remediable": true,
        "remediation": {
          "actions": [
            {
              "operation": "string",
              "payload": "string"
            }
          ],
          "cliScriptTemplate": "string",
          "description": "string"
        },
        "restrictAlertDismissal": true,
        "rule": {
          "apiName": "string",
          "cloudAccount": "string",
          "cloudType": "string",
          "criteria": "string",
          "dataCriteria": {
            "classificationResult": "string",
            "exposure": "private",
            "extension": [
              "string"
            ]
          },
          "name": "string",
          "parameters": {},
          "resourceIdPath": "string",
          "resourceType": "string",
          "type": "Config"
        },
        "ruleLastModifiedOn": 0,
        "severity": "high",
        "systemDefault": true
      },
      "policyId": "string",
      "reason": "string",
      "resource": {
        "account": "string",
        "accountId": "string",
        "additionalInfo": {
          "array": true,
          "bigDecimal": true,
          "bigInteger": true,
          "binary": true,
          "boolean": true,
          "containerNode": true,
          "double": true,
          "float": true,
          "floatingPointNumber": true,
          "int": true,
          "integralNumber": true,
          "long": true,
          "missingNode": true,
          "nodeType": "ARRAY",
          "null": true,
          "number": true,
          "object": true,
          "pojo": true,
          "short": true,
          "textual": true,
          "valueNode": true
        },
        "cloudAccountAncestors": [
          "string"
        ],
        "cloudAccountGroups": [
          "string"
        ],
        "cloudAccountOwners": [
          "string"
        ],
        "cloudServiceName": "string",
        "cloudType": "ALL",
        "data": {},
        "id": "string",
        "name": "string",
        "region": "string",
        "regionId": "string",
        "resourceApiName": "string",
        "resourceConfigJsonAvailable": true,
        "resourceDetailsAvailable": true,
        "resourceTags": {},
        "resourceType": "string",
        "rrn": "string",
        "unifiedAssetId": "string",
        "url": "string"
      },
      "riskDetail": {
        "policyScores": [
          {
            "cloudType": "ALL",
            "complianceMetadata": [
              {
                "complianceId": "string",
                "customAssigned": true,
                "policyId": "string",
                "requirementDescription": "string",
                "requirementId": "string",
                "requirementName": "string",
                "sectionDescription": "string",
                "sectionId": "string",
                "sectionLabel": "string",
                "standardDescription": "string",
                "standardId": "string",
                "standardName": "string"
              }
            ],
            "createdBy": "string",
            "createdOn": 0,
            "deleted": true,
            "description": "string",
            "enabled": true,
            "findingTypes": [
              "string"
            ],
            "labels": [
              "string"
            ],
            "lastModifiedBy": "string",
            "lastModifiedOn": 0,
            "name": "string",
            "overridden": true,
            "points": "string",
            "policyId": "string",
            "policySubTypes": [
              "run"
            ],
            "policyType": "config",
            "policyUpi": "string",
            "recommendation": "string",
            "remediable": true,
            "remediation": {
              "actions": [
                {
                  "operation": "string",
                  "payload": "string"
                }
              ],
              "cliScriptTemplate": "string",
              "description": "string"
            },
            "restrictAlertDismissal": true,
            "riskScore": {
              "maxScore": 0,
              "score": 0
            },
            "rule": {
              "apiName": "string",
              "cloudAccount": "string",
              "cloudType": "string",
              "criteria": "string",
              "dataCriteria": {
                "classificationResult": "string",
                "exposure": "private",
                "extension": [
                  "string"
                ]
              },
              "name": "string",
              "parameters": {},
              "resourceIdPath": "string",
              "resourceType": "string",
              "type": "Config"
            },
            "ruleLastModifiedOn": 0,
            "severity": "high",
            "systemDefault": true
          }
        ],
        "rating": "string",
        "riskScore": {
          "maxScore": 0,
          "score": 0
        },
        "score": "string"
      },
      "saveSearchId": "string",
      "status": "open",
      "triggeredBy": "string"
    }
  ],
  "nextPageToken": "string",
  "sortAllowedColumns": [
    "string"
  ],
  "totalRows": 0
}

internal_error

Too Many Requests

Loading...