List Alerts - POST

POST 
/alert

Returns a list of alerts that matches the constraints specified in the body parameters. Max 10k results. To get more, use List Alerts V2 - POST.

The fields body parameter allows you to request specific fields from the alert payload. These fields are separate from the filters you specify. The following are valid fields items.

• alert.id
• alert.status
• alert.time
• cloud.account
• cloud.accountId
• cloud.region
• resource.id
• resource.name
• policy.name
• policy.type
• policy.severity

The filters body parameter enables you to narrow your request for alerts. See List Alert Filters for an API request to list all the valid filters.

Data in the response object does not include alert rules.

Also, in the response object:

• Property riskDetail is deprecated.
• Property resource.cloudServiceName is populated only for alerts whose resources belong to a cloud service.

Rate Limits

The following rate limits apply:

• Request rate limit: 2/sec
• Burst limit: 10/sec

Request

Query Parameters

detailed boolean

true = Return detailed alert data. Default is false. Overrides detailed in body param.

application/json; charset=UTF-8

Body

detailed boolean

Detailed

fields string[]

Array of specific fields to return

filters object[]
Filtering parameters.
For filter names, refer to List Filters API.
For filter values, refer to List filter suggestions.
The only exception is resource.tagv2 filter name, provide filter value for it in the following format: "{"key":"'CustomerTagKey'","value":"'CustomerTagValue'"}"
Array [
name string
Name
operator string
Possible values: [=]
Operator
value string
Value
]
groupBy string[]

For asset or data inventory only. Group returned items by cloud.type, cloud.service, cloud.region, cloud.account, and/or resource.type

limit number

Maximum number of items to return. When data is paginated, maximum number of items per page.The maximum cannot exceed 10,000. The default is 10,000.

offset number

The number of items to skip before selecting items to return. Default is zero

pageToken string

Setting this pagination Token to the nextPageToken from a response object returns the next page of data

sortBy string[]

Array of sort properties. Append :asc or :desc to the key to sort by ascending or descending order respectively. Example sort properties are id:asc and timestamp:desc

timeRange object

See the Time Range Model for details.

oneOf

RelativeTimeRangeConfigModel

relativeTimeType string

Possible values: [BACKWARD, FORWARD]

Direction in which to count time. Default = BACKWARD

type string

value objectrequired

Model for RelativeTimeDuration

amount int32

Number of time units

unit string

Possible values: [minute, hour, day, week, month, year]

Time unit

AbsoluteTimeRangeConfigModel

type string

value objectrequired

Model for Time

endTime int64

End timestamp

startTime int64

Start timestamp

ToNowTimeRangeConfigModel

value string

Possible values: [MINUTE, HOUR, DAY, WEEK, MONTH, YEAR, EPOCH, LOGIN]

Time range object

Responses

200

successful operation

*/*

Schema

Schema

• Array [
alertAdditionalInfo object
property name* string
alertAttribution object

Model for AlertAttribution

attributionEventList object[]

Array [

event string

Event

event_ts int64

Event Timestamp

username string

Username

]

resourceCreatedBy string

Resource Created By

resourceCreatedOn int64

Resource Created On

alertCount int64
alertRules object[]
Array [
alertRuleNotificationConfig object[]
List of data for notifications to third-party tools
Array [
dayOfMonth int32
Day of month
daysOfWeek object[]
Days of week
Array [
day string
Possible values: [SU, MO, TU, WE, TH, FR, SA]
offset int32
]
detailedReport boolean
Provide csv detailed report
enabled boolean
Scan enabled
frequency string
Possible values: [as_it_happens, daily, weekly, monthly]
frequencyFromRRule string
Frequency from RRule
hourOfDay int32
Hour of day
id string
Alert rule notification config ID
includeRemediation boolean
Include remediation in detailed report
lastUpdated int64
Last Updated
last_sent_ts int64
Time of last notification in milliseconds
recipients string[]
• For email notifications: List of unique email addresses to notify
• For integrations without notification templates: List of integration ids
• For integrations with notification templates: List of notification template ids
rruleSchedule string
templateId string
Template ID
timezone string
Java time zone ID (e.g. America/Los_Angeles)
type string
Possible values: [email, slack, splunk, amazon_sqs, jira, microsoft_teams, webhook, aws_security_hub, google_cscc, service_now, pager_duty, azure_service_bus_queue, demisto, aws_s3, snowflake]
Integration type
withCompression boolean
Compress detailed report
]
allowAutoRemediate boolean
Allow Auto-Remediation
delayNotificationMs int64
Delay notifications by the specified milliseconds
description string
Rule/Scan description
enabled boolean
Rule/Scan is enabled
lastModifiedBy string
Last modified by
lastModifiedOn int64
Last modified on this date/time in milliseconds
name stringrequired
Rule/Scan name
notifyOnDismissed boolean
include dismissed alerts in notification
notifyOnOpen boolean
include open alerts in notification
notifyOnResolved boolean
include resolved alerts in notification
notifyOnSnoozed boolean
include snoozed alerts in notification
policies string[]
List of specific policies to scan
policyLabels string[]
Policy labels
policyScanConfigId string
Policy Scan Config ID
scanAll boolean
Scan all policies
target objectrequired
Model for Target Filter
accountGroups string[]
List of Account group(s)
alertRulePolicyFilter object
Model for Alert Rule Policy Filter
availablePolicyFilters string[]
List of available Alert Rule Policy Filters
cloud.type string[]
Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]
Cloud Type Filter
policy.complianceStandard string[]
Compliance Standard Filter
policy.label string[]
Policy Label Filter
policy.severity string[]
Policy Severity Filter
excludedAccounts string[]
List of excluded accounts
includedResourceLists object
Model for holding the lists resource list ids by resource list type
computeAccessGroupIds string[]
regions string[]
List of regions for which alerts will be triggered for account groups. Alerts not associated with specific regions will be triggered regardless of listed regions. If no regions are specified, then the alerts will be triggered for all regions.
tags object[]
List of TargetTag models (resource tags) for which alerts should be triggered
Array [
key string
Resource tag target
values string[]
List of value(s) for resource tag key
]
]
alertTime int64

Timestamp when alert was last reopened for resource update, or the same as firstSeen if there are no status changes.

appMetadata object[]

Application Metadata from AppDna

connectionDetails object[]
ConnectionDetails for network_event alerts
Array [
accepted string
accountName string
classification string
destIp string
destIsp string
feedSource string
id int32
inboundTrafficVolume int64
markedThreatTs int64
outboundTrafficVolume int64
packets int64
srcIp string
srcIsp string
threatDescription string
timestamp int64
trafficOverTime object[]
trafficVolume int64
]
dismissalDuration string

Dismissal Duration

dismissalNote string

Dismissal note

dismissalUntilTs int64

Dismiss until this timestamp

dismissedBy string

Dismissed by

eventOccurred int64

Timestamp when the event occurred. Set only for Audit Event policies.

firstSeen int64

Timestamp of the first policy violation for the alert resource (i.e. the alert creation timestamp)

history object[]
Array [
reason string
Reason
status string
Possible values: [OPEN, DISMISSED, SNOOZED, PENDING_RESOLUTION, RESOLVED]
Status
]
id string

Alert ID

investigateOptions object

Model for InvestigateOptions

alertId string

alert id

hasSearchExecutionSupport boolean

The flag indicates if the policy has RQL execution support

searchId string

searchId for the policy RQL

lastSeen int64

Timestamp when alert status was last updated.

lastUpdated int64

Timestamp when alert was last updated. Updates include but are not limited to resource updates, policy updates, alert rule updates, and alert status changes.

metadata object

Raw JSON metadata for the alert

policy object

Model for Policy

cloudType string

Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]

Cloud type (Required for config policies). Not case-sensitive. Default is ALL.

complianceMetadata object[]

List of compliance data. Each item has compliance standard, requirement, and/or section information.

Array [

complianceId string

Compliance Section UUID

customAssigned boolean

policyId string

Policy ID

requirementDescription string

Requirement description

requirementId string

Requirement ID

requirementName string

Requirement name

sectionDescription string

Section name

sectionId string

Section Id

sectionLabel string

Section Label

standardDescription string

Compliance standard description

standardId string

standardName string

Compliance standard name

]

createdBy string

Created by

createdOn int64

Created on this timestamp

deleted boolean

Deleted

description string

Policy description

enabled boolean

true=enabled. false=disabled.

findingTypes string[]

Finding Type

labels string[]

Labels

lastModifiedBy string

Last modified by

lastModifiedOn int64

Last modified on this timestamp

name stringrequired

Policy name

overridden boolean

Overridden

policyId string

Policy ID

policySubTypes string[]

Possible values: [run, build, run_and_build, audit, data_classification, dns, malware, network_event, network, ueba, permissions, network_config, identity, sensitive_data_exposure, internet_exposure, injections, vulnerability_scanning, shellshock, known_bots, unknown_bots, virtual_patches, event, misconfig_and_event, misconfig, host, container_image]

Policy subtype

policyType stringrequired

Possible values: [config, network, audit_event, anomaly, data, iam, workload_vulnerability, workload_incident, api, attack_path, malware, grayware]

Policy type. Policy type anomaly is read-only.

policyUpi string

Policy UPI

recommendation string

Remediation recommendation

remediable boolean

isRemediable

remediation object

Model for Remediation

actions object[]

Policy Action

Array [

operation string

payload string

]

cliScriptTemplate string

CLI Script Template

description string

Description

restrictAlertDismissal boolean

Restrict alert dismissal

rule objectrequired

Model for Rule

apiName string

API name

cloudAccount string

Cloud account

cloudType string

Cloud type

criteria stringrequired

Saved search ID that defines the rule criteria.

dataCriteria object

Criteria for Rule

classificationResult string

Data policy. Required for DLP rule criteria.

exposure string

Possible values: [private, public, conditional]

File exposure

extension string[]

File extensions

name stringrequired

Name

parameters objectrequired

Parameters (e.g. {"savedSearch": "true"})

property name* string

resourceIdPath string

Resource ID path

resourceType string

Resource type

type stringrequired

Possible values: [Config, Network, AuditEvent, DLP, IAM, NetworkConfig]

Type of rule or RQL query

ruleLastModifiedOn int64

Rule last modified on

severity stringrequired

Possible values: [high, medium, low]

Severity

systemDefault boolean

true = Policy is a Prisma Cloud system default policy

policyId string

Policy ID

reason string

The reason for an alert's status. For more information on Alert reasons see View and Respond to Prisma Cloud Alerts and Prisma Cloud Alert Resolution Reasons

resource object

Model for Cloud Resource

account string

Account

accountId string

Account ID

additionalInfo object

Additional info

array boolean

bigDecimal boolean

bigInteger boolean

binary boolean

boolean boolean

containerNode boolean

double boolean

float boolean

floatingPointNumber boolean

int boolean

integralNumber boolean

long boolean

missingNode boolean

nodeType string

Possible values: [ARRAY, BINARY, BOOLEAN, MISSING, NULL, NUMBER, OBJECT, POJO, STRING]

null boolean

number boolean

object boolean

pojo boolean

short boolean

textual boolean

valueNode boolean

cloudAccountAncestors string[]

Cloud account ancestors. For GCP.

cloudAccountGroups string[]

Cloud account groups

cloudAccountOwners string[]

Cloud account owners. For Azure and GCP.

cloudServiceName string

Cloud service name

cloudType string

Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]

Cloud type

data object

Raw JSON data for the resource

id string

Id

name string

Name

region string

Region name

regionId string

Region API identifier

resourceApiName string

Resource API name

resourceConfigJsonAvailable boolean

resourceDetailsAvailable boolean

resourceTags object

Resource tags

property name* string

resourceType string

Resource type

rrn string

RRN

unifiedAssetId string

url string

URL

riskDetail object

Model for Risk Detail

policyScores object[]

Array [

cloudType string

Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]

Cloud type (Required for config policies). Not case-sensitive. Default is ALL.

complianceMetadata object[]

List of compliance data. Each item has compliance standard, requirement, and/or section information.

Array [

complianceId string

Compliance Section UUID

customAssigned boolean

policyId string

Policy ID

requirementDescription string

Requirement description

requirementId string

Requirement ID

requirementName string

Requirement name

sectionDescription string

Section name

sectionId string

Section Id

sectionLabel string

Section Label

standardDescription string

Compliance standard description

standardId string

standardName string

Compliance standard name

]

createdBy string

Created by

createdOn int64

Created on this timestamp

deleted boolean

Deleted

description string

Policy description

enabled boolean

true=enabled. false=disabled.

findingTypes string[]

Finding Type

labels string[]

Labels

lastModifiedBy string

Last modified by

lastModifiedOn int64

Last modified on this timestamp

name stringrequired

Policy name

overridden boolean

Overridden

points string

Points

policyId string

Policy ID

policySubTypes string[]

Possible values: [run, build, run_and_build, audit, data_classification, dns, malware, network_event, network, ueba, permissions, network_config, identity, sensitive_data_exposure, internet_exposure, injections, vulnerability_scanning, shellshock, known_bots, unknown_bots, virtual_patches, event, misconfig_and_event, misconfig, host, container_image]

Policy subtype

policyType stringrequired

Possible values: [config, network, audit_event, anomaly, data, iam, workload_vulnerability, workload_incident, api, attack_path, malware, grayware]

Policy type. Policy type anomaly is read-only.

policyUpi string

Policy UPI

recommendation string

Remediation recommendation

remediable boolean

isRemediable

remediation object

Model for Remediation

actions object[]

Policy Action

Array [

operation string

payload string

]

cliScriptTemplate string

CLI Script Template

description string

Description

restrictAlertDismissal boolean

Restrict alert dismissal

riskScore object

Model for Score

maxScore int64

Max Score

score int64

Score

rule objectrequired

Model for Rule

apiName string

API name

cloudAccount string

Cloud account

cloudType string

Cloud type

criteria stringrequired

Saved search ID that defines the rule criteria.

dataCriteria object

Criteria for Rule

classificationResult string

Data policy. Required for DLP rule criteria.

exposure string

Possible values: [private, public, conditional]

File exposure

extension string[]

File extensions

name stringrequired

Name

parameters objectrequired

Parameters (e.g. {"savedSearch": "true"})

property name* string

resourceIdPath string

Resource ID path

resourceType string

Resource type

type stringrequired

Possible values: [Config, Network, AuditEvent, DLP, IAM, NetworkConfig]

Type of rule or RQL query

ruleLastModifiedOn int64

Rule last modified on

severity stringrequired

Possible values: [high, medium, low]

Severity

systemDefault boolean

true = Policy is a Prisma Cloud system default policy

]

rating string

Rating

riskScore object

Model for Score

maxScore int64

Max Score

score int64

Score

score string

Score

saveSearchId string

Saved Search ID

status string

Possible values: [open, dismissed, snoozed, resolved, pending_resolution]

Status

triggeredBy string

Triggered By

• ]

Example (from schema)

[
  {
    "alertAdditionalInfo": {},
    "alertAttribution": {
      "attributionEventList": [
        {
          "event": "string",
          "event_ts": 0,
          "username": "string"
        }
      ],
      "resourceCreatedBy": "string",
      "resourceCreatedOn": 0
    },
    "alertCount": 0,
    "alertRules": [
      {
        "alertRuleNotificationConfig": [
          {
            "dayOfMonth": 0,
            "daysOfWeek": [
              {
                "day": "SU",
                "offset": 0
              }
            ],
            "detailedReport": true,
            "enabled": true,
            "frequency": "as_it_happens",
            "frequencyFromRRule": "string",
            "hourOfDay": 0,
            "id": "string",
            "includeRemediation": true,
            "lastUpdated": 0,
            "last_sent_ts": 0,
            "recipients": [
              "string"
            ],
            "rruleSchedule": "string",
            "templateId": "string",
            "timezone": "string",
            "type": "email",
            "withCompression": true
          }
        ],
        "allowAutoRemediate": true,
        "delayNotificationMs": 0,
        "description": "string",
        "enabled": true,
        "lastModifiedBy": "string",
        "lastModifiedOn": 0,
        "name": "string",
        "notifyOnDismissed": true,
        "notifyOnOpen": true,
        "notifyOnResolved": true,
        "notifyOnSnoozed": true,
        "policies": [
          "string"
        ],
        "policyLabels": [
          "string"
        ],
        "policyScanConfigId": "string",
        "scanAll": true,
        "target": {
          "accountGroups": [
            "string"
          ],
          "alertRulePolicyFilter": {
            "availablePolicyFilters": [
              "string"
            ],
            "cloud.type": [
              "ALL"
            ],
            "policy.complianceStandard": [
              "string"
            ],
            "policy.label": [
              "string"
            ],
            "policy.severity": [
              "string"
            ]
          },
          "excludedAccounts": [
            "string"
          ],
          "includedResourceLists": {
            "computeAccessGroupIds": [
              "string"
            ]
          },
          "regions": [
            "string"
          ],
          "tags": [
            {
              "key": "string",
              "values": [
                "string"
              ]
            }
          ]
        }
      }
    ],
    "alertTime": 0,
    "appMetadata": [
      {}
    ],
    "connectionDetails": [
      {
        "accepted": "string",
        "accountName": "string",
        "classification": "string",
        "destIp": "string",
        "destIsp": "string",
        "feedSource": "string",
        "id": 0,
        "inboundTrafficVolume": 0,
        "markedThreatTs": 0,
        "outboundTrafficVolume": 0,
        "packets": 0,
        "srcIp": "string",
        "srcIsp": "string",
        "threatDescription": "string",
        "timestamp": 0,
        "trafficOverTime": [
          {}
        ],
        "trafficVolume": 0
      }
    ],
    "dismissalDuration": "string",
    "dismissalNote": "string",
    "dismissalUntilTs": 0,
    "dismissedBy": "string",
    "eventOccurred": 0,
    "firstSeen": 0,
    "history": [
      {
        "reason": "string",
        "status": "OPEN"
      }
    ],
    "id": "string",
    "investigateOptions": {
      "alertId": "string",
      "hasSearchExecutionSupport": true,
      "searchId": "string"
    },
    "lastSeen": 0,
    "lastUpdated": 0,
    "metadata": {},
    "policy": {
      "cloudType": "ALL",
      "complianceMetadata": [
        {
          "complianceId": "string",
          "customAssigned": true,
          "policyId": "string",
          "requirementDescription": "string",
          "requirementId": "string",
          "requirementName": "string",
          "sectionDescription": "string",
          "sectionId": "string",
          "sectionLabel": "string",
          "standardDescription": "string",
          "standardId": "string",
          "standardName": "string"
        }
      ],
      "createdBy": "string",
      "createdOn": 0,
      "deleted": true,
      "description": "string",
      "enabled": true,
      "findingTypes": [
        "string"
      ],
      "labels": [
        "string"
      ],
      "lastModifiedBy": "string",
      "lastModifiedOn": 0,
      "name": "string",
      "overridden": true,
      "policyId": "string",
      "policySubTypes": [
        "run"
      ],
      "policyType": "config",
      "policyUpi": "string",
      "recommendation": "string",
      "remediable": true,
      "remediation": {
        "actions": [
          {
            "operation": "string",
            "payload": "string"
          }
        ],
        "cliScriptTemplate": "string",
        "description": "string"
      },
      "restrictAlertDismissal": true,
      "rule": {
        "apiName": "string",
        "cloudAccount": "string",
        "cloudType": "string",
        "criteria": "string",
        "dataCriteria": {
          "classificationResult": "string",
          "exposure": "private",
          "extension": [
            "string"
          ]
        },
        "name": "string",
        "parameters": {},
        "resourceIdPath": "string",
        "resourceType": "string",
        "type": "Config"
      },
      "ruleLastModifiedOn": 0,
      "severity": "high",
      "systemDefault": true
    },
    "policyId": "string",
    "reason": "string",
    "resource": {
      "account": "string",
      "accountId": "string",
      "additionalInfo": {
        "array": true,
        "bigDecimal": true,
        "bigInteger": true,
        "binary": true,
        "boolean": true,
        "containerNode": true,
        "double": true,
        "float": true,
        "floatingPointNumber": true,
        "int": true,
        "integralNumber": true,
        "long": true,
        "missingNode": true,
        "nodeType": "ARRAY",
        "null": true,
        "number": true,
        "object": true,
        "pojo": true,
        "short": true,
        "textual": true,
        "valueNode": true
      },
      "cloudAccountAncestors": [
        "string"
      ],
      "cloudAccountGroups": [
        "string"
      ],
      "cloudAccountOwners": [
        "string"
      ],
      "cloudServiceName": "string",
      "cloudType": "ALL",
      "data": {},
      "id": "string",
      "name": "string",
      "region": "string",
      "regionId": "string",
      "resourceApiName": "string",
      "resourceConfigJsonAvailable": true,
      "resourceDetailsAvailable": true,
      "resourceTags": {},
      "resourceType": "string",
      "rrn": "string",
      "unifiedAssetId": "string",
      "url": "string"
    },
    "riskDetail": {
      "policyScores": [
        {
          "cloudType": "ALL",
          "complianceMetadata": [
            {
              "complianceId": "string",
              "customAssigned": true,
              "policyId": "string",
              "requirementDescription": "string",
              "requirementId": "string",
              "requirementName": "string",
              "sectionDescription": "string",
              "sectionId": "string",
              "sectionLabel": "string",
              "standardDescription": "string",
              "standardId": "string",
              "standardName": "string"
            }
          ],
          "createdBy": "string",
          "createdOn": 0,
          "deleted": true,
          "description": "string",
          "enabled": true,
          "findingTypes": [
            "string"
          ],
          "labels": [
            "string"
          ],
          "lastModifiedBy": "string",
          "lastModifiedOn": 0,
          "name": "string",
          "overridden": true,
          "points": "string",
          "policyId": "string",
          "policySubTypes": [
            "run"
          ],
          "policyType": "config",
          "policyUpi": "string",
          "recommendation": "string",
          "remediable": true,
          "remediation": {
            "actions": [
              {
                "operation": "string",
                "payload": "string"
              }
            ],
            "cliScriptTemplate": "string",
            "description": "string"
          },
          "restrictAlertDismissal": true,
          "riskScore": {
            "maxScore": 0,
            "score": 0
          },
          "rule": {
            "apiName": "string",
            "cloudAccount": "string",
            "cloudType": "string",
            "criteria": "string",
            "dataCriteria": {
              "classificationResult": "string",
              "exposure": "private",
              "extension": [
                "string"
              ]
            },
            "name": "string",
            "parameters": {},
            "resourceIdPath": "string",
            "resourceType": "string",
            "type": "Config"
          },
          "ruleLastModifiedOn": 0,
          "severity": "high",
          "systemDefault": true
        }
      ],
      "rating": "string",
      "riskScore": {
        "maxScore": 0,
        "score": 0
      },
      "score": "string"
    },
    "saveSearchId": "string",
    "status": "open",
    "triggeredBy": "string"
  }
]

400

internal_error

429

Too Many Requests

Loading...