Skip to main content

List Alert Counts By Policy - POST

POST 

/alert/policy

Returns alert counts grouped by policy. You can use body parameters to narrow the response.

In the response object:

  • Property alertRules is not populated.
  • Property riskDetail is deprecated.
  • Property resource.cloudServiceName is not populated.

Rate Limits

The following rate limits apply:

  • Request rate limit: 1/sec
  • Burst limit: 5/sec

Request

Query Parameters

    detailed boolean

    true = Return detailed alert data. Default is false. Overrides detailed in body param.

Body

required

Model for Filter

    detailed boolean

    Detailed

    fields string[]

    Array of specific fields to return

    filters object[]

    Filtering parameters.

    For filter names, refer to List Filters API.

    For filter values, refer to List filter suggestions.

    The only exception is resource.tagv2 filter name, provide filter value for it in the following format: "{"key":"'CustomerTagKey'","value":"'CustomerTagValue'"}"

  • Array [
  • name string

    Name

    operator string

    Possible values: [=]

    Operator

    value string

    Value

  • ]
  • groupBy string[]

    For asset or data inventory only. Group returned items by cloud.type, cloud.service, cloud.region, cloud.account, and/or resource.type

    limit number

    Maximum number of items to return. When data is paginated, maximum number of items per page.The maximum cannot exceed 10,000. The default is 10,000.

    offset number

    The number of items to skip before selecting items to return. Default is zero

    pageToken string

    Setting this pagination Token to the nextPageToken from a response object returns the next page of data

    sortBy string[]

    Array of sort properties. Append :asc or :desc to the key to sort by ascending or descending order respectively. Example sort properties are id:asc and timestamp:desc

    timeRange object

    See the Time Range Model for details.

    oneOf
    relativeTimeType string

    Possible values: [BACKWARD, FORWARD]

    Direction in which to count time. Default = BACKWARD

    type string
    value objectrequired

    Model for RelativeTimeDuration

    amount int32

    Number of time units

    unit string

    Possible values: [minute, hour, day, week, month, year]

    Time unit

    type stringrequired

    Possible values: [absolute, relative, to_now]

    Time type

    type string
    value objectrequired

    Model for Time

    endTime int64

    End timestamp

    startTime int64

    Start timestamp

Responses

successful operation

Schema
  • Array [
  • alertAdditionalInfo object
    property name* string
    alertAttribution object

    Model for AlertAttribution

    attributionEventList object[]
  • Array [
  • event string

    Event

    event_ts int64

    Event Timestamp

    username string

    Username

  • ]
  • resourceCreatedBy string

    Resource Created By

    resourceCreatedOn int64

    Resource Created On

    alertCount int64
    alertRules object[]
  • Array [
  • alertRuleNotificationConfig object[]

    List of data for notifications to third-party tools

  • Array [
  • dayOfMonth int32

    Day of month

    daysOfWeek object[]

    Days of week

  • Array [
  • day string

    Possible values: [SU, MO, TU, WE, TH, FR, SA]

    offset int32
  • ]
  • detailedReport boolean

    Provide csv detailed report

    enabled boolean

    Scan enabled

    frequency string

    Possible values: [as_it_happens, daily, weekly, monthly]

    frequencyFromRRule string

    Frequency from RRule

    hourOfDay int32

    Hour of day

    id string

    Alert rule notification config ID

    includeRemediation boolean

    Include remediation in detailed report

    lastUpdated int64

    Last Updated

    last_sent_ts int64

    Time of last notification in milliseconds

    recipients string[]
    • For email notifications: List of unique email addresses to notify
    • For integrations without notification templates: List of integration ids
    • For integrations with notification templates: List of notification template ids
    rruleSchedule string
    templateId string

    Template ID

    timezone string

    Java time zone ID (e.g. America/Los_Angeles)

    type string

    Possible values: [email, slack, splunk, amazon_sqs, jira, microsoft_teams, webhook, aws_security_hub, google_cscc, service_now, pager_duty, azure_service_bus_queue, demisto, aws_s3, snowflake]

    Integration type

    withCompression boolean

    Compress detailed report

  • ]
  • allowAutoRemediate boolean

    Allow Auto-Remediation

    delayNotificationMs int64

    Delay notifications by the specified milliseconds

    description string

    Rule/Scan description

    enabled boolean

    Rule/Scan is enabled

    lastModifiedBy string

    Last modified by

    lastModifiedOn int64

    Last modified on this date/time in milliseconds

    name stringrequired

    Rule/Scan name

    notifyOnDismissed boolean

    include dismissed alerts in notification

    notifyOnOpen boolean

    include open alerts in notification

    notifyOnResolved boolean

    include resolved alerts in notification

    notifyOnSnoozed boolean

    include snoozed alerts in notification

    policies string[]

    List of specific policies to scan

    policyLabels string[]

    Policy labels

    policyScanConfigId string

    Policy Scan Config ID

    scanAll boolean

    Scan all policies

    target objectrequired

    Model for Target Filter

    accountGroups string[]

    List of Account group(s)

    alertRulePolicyFilter object

    Model for Alert Rule Policy Filter

    availablePolicyFilters string[]

    List of available Alert Rule Policy Filters

    cloud.type string[]

    Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]

    Cloud Type Filter

    policy.complianceStandard string[]

    Compliance Standard Filter

    policy.label string[]

    Policy Label Filter

    policy.severity string[]

    Policy Severity Filter

    excludedAccounts string[]

    List of excluded accounts

    includedResourceLists object

    Model for holding the lists resource list ids by resource list type

    computeAccessGroupIds string[]
    regions string[]

    List of regions for which alerts will be triggered for account groups. Alerts not associated with specific regions will be triggered regardless of listed regions. If no regions are specified, then the alerts will be triggered for all regions.

    tags object[]

    List of TargetTag models (resource tags) for which alerts should be triggered

  • Array [
  • key string

    Resource tag target

    values string[]

    List of value(s) for resource tag key

  • ]
  • ]
  • alertTime int64

    Timestamp when alert was last reopened for resource update, or the same as firstSeen if there are no status changes.

    appMetadata object[]

    Application Metadata from AppDna

    dismissalDuration string

    Dismissal Duration

    dismissalNote string

    Dismissal note

    dismissalUntilTs int64

    Dismiss until this timestamp

    dismissedBy string

    Dismissed by

    eventOccurred int64

    Timestamp when the event occurred. Set only for Audit Event policies.

    firstSeen int64

    Timestamp of the first policy violation for the alert resource (i.e. the alert creation timestamp)

    history object[]
  • Array [
  • reason string

    Reason

    status string

    Possible values: [OPEN, DISMISSED, SNOOZED, PENDING_RESOLUTION, RESOLVED]

    Status

  • ]
  • id string

    Alert ID

    lastSeen int64

    Timestamp when alert status was last updated.

    lastUpdated int64

    Timestamp when alert was last updated. Updates include but are not limited to resource updates, policy updates, alert rule updates, and alert status changes.

    metadata object

    Raw JSON metadata for the alert

    policy object

    Model for Policy

    cloudType string

    Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]

    Cloud type (Required for config policies). Not case-sensitive. Default is ALL.

    complianceMetadata object[]

    List of compliance data. Each item has compliance standard, requirement, and/or section information.

  • Array [
  • complianceId string

    Compliance Section UUID

    customAssigned boolean
    policyId string

    Policy ID

    requirementDescription string

    Requirement description

    requirementId string

    Requirement ID

    requirementName string

    Requirement name

    sectionDescription string

    Section name

    sectionId string

    Section Id

    sectionLabel string

    Section Label

    standardDescription string

    Compliance standard description

    standardId string
    standardName string

    Compliance standard name

  • ]
  • createdBy string

    Created by

    createdOn int64

    Created on this timestamp

    deleted boolean

    Deleted

    description string

    Policy description

    enabled boolean

    true=enabled. false=disabled.

    findingTypes string[]

    Finding Type

    labels string[]

    Labels

    lastModifiedBy string

    Last modified by

    lastModifiedOn int64

    Last modified on this timestamp

    name stringrequired

    Policy name

    overridden boolean

    Overridden

    policyId string

    Policy ID

    policySubTypes string[]

    Possible values: [run, build, run_and_build, audit, data_classification, dns, malware, network_event, network, ueba, permissions, network_config, identity, sensitive_data_exposure, internet_exposure, injections, vulnerability_scanning, shellshock, known_bots, unknown_bots, virtual_patches, event, misconfig_and_event, misconfig, host, container_image]

    Policy subtype

    policyType stringrequired

    Possible values: [config, network, audit_event, anomaly, data, iam, workload_vulnerability, workload_incident, api, attack_path, malware, grayware]

    Policy type. Policy type anomaly is read-only.

    policyUpi string

    Policy UPI

    recommendation string

    Remediation recommendation

    remediable boolean

    isRemediable

    remediation object

    Model for Remediation

    actions object[]

    Policy Action

  • Array [
  • operation string
    payload string
  • ]
  • cliScriptTemplate string

    CLI Script Template

    description string

    Description

    restrictAlertDismissal boolean

    Restrict alert dismissal

    rule objectrequired

    Model for Rule

    apiName string

    API name

    cloudAccount string

    Cloud account

    cloudType string

    Cloud type

    criteria stringrequired

    Saved search ID that defines the rule criteria.

    dataCriteria object

    Criteria for Rule

    classificationResult string

    Data policy. Required for DLP rule criteria.

    exposure string

    Possible values: [private, public, conditional]

    File exposure

    extension string[]

    File extensions

    name stringrequired

    Name

    parameters objectrequired

    Parameters (e.g. {"savedSearch": "true"})

    property name* string
    resourceIdPath string

    Resource ID path

    resourceType string

    Resource type

    type stringrequired

    Possible values: [Config, Network, AuditEvent, DLP, IAM, NetworkConfig]

    Type of rule or RQL query

    ruleLastModifiedOn int64

    Rule last modified on

    severity stringrequired

    Possible values: [high, medium, low]

    Severity

    systemDefault boolean

    true = Policy is a Prisma Cloud system default policy

    policyId string

    Policy ID

    reason string

    Reason

    resource object

    Model for Cloud Resource

    account string

    Account

    accountId string

    Account ID

    additionalInfo object

    Additional info

    array boolean
    bigDecimal boolean
    bigInteger boolean
    binary boolean
    boolean boolean
    containerNode boolean
    double boolean
    float boolean
    floatingPointNumber boolean
    int boolean
    integralNumber boolean
    long boolean
    missingNode boolean
    nodeType string

    Possible values: [ARRAY, BINARY, BOOLEAN, MISSING, NULL, NUMBER, OBJECT, POJO, STRING]

    null boolean
    number boolean
    object boolean
    pojo boolean
    short boolean
    textual boolean
    valueNode boolean
    cloudAccountAncestors string[]

    Cloud account ancestors. For GCP.

    cloudAccountGroups string[]

    Cloud account groups

    cloudAccountOwners string[]

    Cloud account owners. For Azure and GCP.

    cloudServiceName string

    Cloud service name

    cloudType string

    Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]

    Cloud type

    data object

    Raw JSON data for the resource

    id string

    Id

    name string

    Name

    region string

    Region name

    regionId string

    Region API identifier

    resourceApiName string

    Resource API name

    resourceConfigJsonAvailable boolean
    resourceDetailsAvailable boolean
    resourceTags object

    Resource tags

    property name* string
    resourceType string

    Resource type

    rrn string

    RRN

    unifiedAssetId string
    url string

    URL

    riskDetail object

    Model for Risk Detail

    policyScores object[]
  • Array [
  • cloudType string

    Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]

    Cloud type (Required for config policies). Not case-sensitive. Default is ALL.

    complianceMetadata object[]

    List of compliance data. Each item has compliance standard, requirement, and/or section information.

  • Array [
  • complianceId string

    Compliance Section UUID

    customAssigned boolean
    policyId string

    Policy ID

    requirementDescription string

    Requirement description

    requirementId string

    Requirement ID

    requirementName string

    Requirement name

    sectionDescription string

    Section name

    sectionId string

    Section Id

    sectionLabel string

    Section Label

    standardDescription string

    Compliance standard description

    standardId string
    standardName string

    Compliance standard name

  • ]
  • createdBy string

    Created by

    createdOn int64

    Created on this timestamp

    deleted boolean

    Deleted

    description string

    Policy description

    enabled boolean

    true=enabled. false=disabled.

    findingTypes string[]

    Finding Type

    labels string[]

    Labels

    lastModifiedBy string

    Last modified by

    lastModifiedOn int64

    Last modified on this timestamp

    name stringrequired

    Policy name

    overridden boolean

    Overridden

    points string

    Points

    policyId string

    Policy ID

    policySubTypes string[]

    Possible values: [run, build, run_and_build, audit, data_classification, dns, malware, network_event, network, ueba, permissions, network_config, identity, sensitive_data_exposure, internet_exposure, injections, vulnerability_scanning, shellshock, known_bots, unknown_bots, virtual_patches, event, misconfig_and_event, misconfig, host, container_image]

    Policy subtype

    policyType stringrequired

    Possible values: [config, network, audit_event, anomaly, data, iam, workload_vulnerability, workload_incident, api, attack_path, malware, grayware]

    Policy type. Policy type anomaly is read-only.

    policyUpi string

    Policy UPI

    recommendation string

    Remediation recommendation

    remediable boolean

    isRemediable

    remediation object

    Model for Remediation

    actions object[]

    Policy Action

  • Array [
  • operation string
    payload string
  • ]
  • cliScriptTemplate string

    CLI Script Template

    description string

    Description

    restrictAlertDismissal boolean

    Restrict alert dismissal

    riskScore object

    Model for Score

    maxScore int64

    Max Score

    score int64

    Score

    rule objectrequired

    Model for Rule

    apiName string

    API name

    cloudAccount string

    Cloud account

    cloudType string

    Cloud type

    criteria stringrequired

    Saved search ID that defines the rule criteria.

    dataCriteria object

    Criteria for Rule

    classificationResult string

    Data policy. Required for DLP rule criteria.

    exposure string

    Possible values: [private, public, conditional]

    File exposure

    extension string[]

    File extensions

    name stringrequired

    Name

    parameters objectrequired

    Parameters (e.g. {"savedSearch": "true"})

    property name* string
    resourceIdPath string

    Resource ID path

    resourceType string

    Resource type

    type stringrequired

    Possible values: [Config, Network, AuditEvent, DLP, IAM, NetworkConfig]

    Type of rule or RQL query

    ruleLastModifiedOn int64

    Rule last modified on

    severity stringrequired

    Possible values: [high, medium, low]

    Severity

    systemDefault boolean

    true = Policy is a Prisma Cloud system default policy

  • ]
  • rating string

    Rating

    riskScore object

    Model for Score

    maxScore int64

    Max Score

    score int64

    Score

    score string

    Score

    saveSearchId string

    Saved Search ID

    status string

    Possible values: [open, dismissed, snoozed, resolved, pending_resolution]

    Status

    triggeredBy string

    Triggered By

  • ]
Loading...