List Alerts V2 - POST

POST 
/v2/alert

Returns a paginated list of alerts that matches the constraints specified in the body parameters.

The fields request body parameter allows you to request specific fields from the alert payload. These fields are separate from the filters you specify. The following are valid fields items.

• alert.id
• alert.status
• alert.time
• cloud.account
• cloud.accountId
• cloud.region
• resource.id
• resource.name
• policy.name
• policy.type
• policy.severity

The filters request body parameter enables you to narrow your request for alerts. See List Alert Filters for an API request to list all the valid filters.

You can find the valid values for the sortBy request body parameter in the response object attribute sortAllowedColumns.

Data in the response object does not include alert rules.

Also, in the response object:

• Property riskDetail is deprecated.
• Property items[].resource.cloudServiceName is populated only for alerts whose resources belong to a cloud service.

Rate Limits

The following rate limits apply:

• Request rate limit: 2/sec
• Burst limit: 10/sec

Request

Query Parameters

detailed boolean

true = Return detailed alert data. Default is false. Overrides detailed in body param.

application/json; charset=UTF-8

Body

detailed boolean

Detailed

fields string[]

Array of specific fields to return

filters object[]
Filtering parameters.
For filter names, refer to List Filters API.
For filter values, refer to List filter suggestions.
The only exception is resource.tagv2 filter name, provide filter value for it in the following format: "{"key":"'CustomerTagKey'","value":"'CustomerTagValue'"}"
Array [
name string
Name
operator string
Possible values: [=]
Operator
value string
Value
]
groupBy string[]

For asset or data inventory only. Group returned items by cloud.type, cloud.service, cloud.region, cloud.account, and/or resource.type

limit number

Maximum number of items to return. When data is paginated, maximum number of items per page.The maximum cannot exceed 10,000. The default is 10,000.

offset number

The number of items to skip before selecting items to return. Default is zero

pageToken string

Setting this pagination Token to the nextPageToken from a response object returns the next page of data

sortBy string[]

Array of sort properties. Append :asc or :desc to the key to sort by ascending or descending order respectively. Example sort properties are id:asc and timestamp:desc

timeRange object

See the Time Range Model for details.

oneOf

RelativeTimeRangeConfigModel

relativeTimeType string

Possible values: [BACKWARD, FORWARD]

Direction in which to count time. Default = BACKWARD

type string

value objectrequired

Model for RelativeTimeDuration

amount int32

Number of time units

unit string

Possible values: [minute, hour, day, week, month, year]

Time unit

AbsoluteTimeRangeConfigModel

type string

value objectrequired

Model for Time

endTime int64

End timestamp

startTime int64

Start timestamp

ToNowTimeRangeConfigModel

value string

Possible values: [MINUTE, HOUR, DAY, WEEK, MONTH, YEAR, EPOCH, LOGIN]

Time range object

Responses

200

successful operation

*/*

Schema

Schema

dynamicColumns string[]
infoMsg string
items object[]
Array [
alertAdditionalInfo object
property name* string
alertAttribution object
Model for AlertAttribution
attributionEventList object[]
Array [
event string
Event
event_ts int64
Event Timestamp
username string
Username
]
resourceCreatedBy string
Resource Created By
resourceCreatedOn int64
Resource Created On
alertCount int64
alertRules object[]
Array [
alertRuleNotificationConfig object[]
List of data for notifications to third-party tools
Array [
dayOfMonth int32
Day of month
daysOfWeek object[]
Days of week
Array [
day string
Possible values: [SU, MO, TU, WE, TH, FR, SA]
offset int32
]
detailedReport boolean
Provide csv detailed report
enabled boolean
Scan enabled
frequency string
Possible values: [as_it_happens, daily, weekly, monthly]
frequencyFromRRule string
Frequency from RRule
hourOfDay int32
Hour of day
id string
Alert rule notification config ID
includeRemediation boolean
Include remediation in detailed report
lastUpdated int64
Last Updated
last_sent_ts int64
Time of last notification in milliseconds
recipients string[]
• For email notifications: List of unique email addresses to notify
• For integrations without notification templates: List of integration ids
• For integrations with notification templates: List of notification template ids
rruleSchedule string
templateId string
Template ID
timezone string
Java time zone ID (e.g. America/Los_Angeles)
type string
Possible values: [email, slack, splunk, amazon_sqs, jira, microsoft_teams, webhook, aws_security_hub, google_cscc, service_now, pager_duty, azure_service_bus_queue, demisto, aws_s3, snowflake]
Integration type
withCompression boolean
Compress detailed report
]
allowAutoRemediate boolean
Allow Auto-Remediation
delayNotificationMs int64
Delay notifications by the specified milliseconds
description string
Rule/Scan description
enabled boolean
Rule/Scan is enabled
lastModifiedBy string
Last modified by
lastModifiedOn int64
Last modified on this date/time in milliseconds
name stringrequired
Rule/Scan name
notifyOnDismissed boolean
include dismissed alerts in notification
notifyOnOpen boolean
include open alerts in notification
notifyOnResolved boolean
include resolved alerts in notification
notifyOnSnoozed boolean
include snoozed alerts in notification
policies string[]
List of specific policies to scan
policyLabels string[]
Policy labels
policyScanConfigId string
Policy Scan Config ID
scanAll boolean
Scan all policies
target objectrequired
Model for Target Filter
accountGroups string[]
List of Account group(s)
alertRulePolicyFilter object
Model for Alert Rule Policy Filter
availablePolicyFilters string[]
List of available Alert Rule Policy Filters
cloud.type string[]
Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]
Cloud Type Filter
policy.complianceStandard string[]
Compliance Standard Filter
policy.label string[]
Policy Label Filter
policy.severity string[]
Policy Severity Filter
excludedAccounts string[]
List of excluded accounts
includedResourceLists object
Model for holding the lists resource list ids by resource list type
computeAccessGroupIds string[]
regions string[]
List of regions for which alerts will be triggered for account groups. Alerts not associated with specific regions will be triggered regardless of listed regions. If no regions are specified, then the alerts will be triggered for all regions.
tags object[]
List of TargetTag models (resource tags) for which alerts should be triggered
Array [
key string
Resource tag target
values string[]
List of value(s) for resource tag key
]
]
alertTime int64
Timestamp when alert was last reopened for resource update, or the same as firstSeen if there are no status changes.
appMetadata object[]
Application Metadata from AppDna
connectionDetails object[]
ConnectionDetails for network_event alerts
Array [
accepted string
accountName string
classification string
destIp string
destIsp string
feedSource string
id int32
inboundTrafficVolume int64
markedThreatTs int64
outboundTrafficVolume int64
packets int64
srcIp string
srcIsp string
threatDescription string
timestamp int64
trafficOverTime object[]
trafficVolume int64
]
dismissalDuration string
Dismissal Duration
dismissalNote string
Dismissal note
dismissalUntilTs int64
Dismiss until this timestamp
dismissedBy string
Dismissed by
eventOccurred int64
Timestamp when the event occurred. Set only for Audit Event policies.
firstSeen int64
Timestamp of the first policy violation for the alert resource (i.e. the alert creation timestamp)
history object[]
Array [
reason string
Reason
status string
Possible values: [OPEN, DISMISSED, SNOOZED, PENDING_RESOLUTION, RESOLVED]
Status
]
id string
Alert ID
investigateOptions object
Model for InvestigateOptions
alertId string
alert id
hasSearchExecutionSupport boolean
The flag indicates if the policy has RQL execution support
searchId string
searchId for the policy RQL
lastSeen int64
Timestamp when alert status was last updated.
lastUpdated int64
Timestamp when alert was last updated. Updates include but are not limited to resource updates, policy updates, alert rule updates, and alert status changes.
metadata object
Raw JSON metadata for the alert
policy object
Model for Policy
cloudType string
Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]
Cloud type (Required for config policies). Not case-sensitive. Default is ALL.
complianceMetadata object[]
List of compliance data. Each item has compliance standard, requirement, and/or section information.
Array [
complianceId string
Compliance Section UUID
customAssigned boolean
policyId string
Policy ID
requirementDescription string
Requirement description
requirementId string
Requirement ID
requirementName string
Requirement name
sectionDescription string
Section name
sectionId string
Section Id
sectionLabel string
Section Label
standardDescription string
Compliance standard description
standardId string
standardName string
Compliance standard name
]
createdBy string
Created by
createdOn int64
Created on this timestamp
deleted boolean
Deleted
description string
Policy description
enabled boolean
true=enabled. false=disabled.
findingTypes string[]
Finding Type
labels string[]
Labels
lastModifiedBy string
Last modified by
lastModifiedOn int64
Last modified on this timestamp
name stringrequired
Policy name
overridden boolean
Overridden
policyId string
Policy ID
policySubTypes string[]
Possible values: [run, build, run_and_build, audit, data_classification, dns, malware, network_event, network, ueba, permissions, network_config, identity, sensitive_data_exposure, internet_exposure, injections, vulnerability_scanning, shellshock, known_bots, unknown_bots, virtual_patches, event, misconfig_and_event, misconfig, host, container_image]
Policy subtype
policyType stringrequired
Possible values: [config, network, audit_event, anomaly, data, iam, workload_vulnerability, workload_incident, api, attack_path, malware, grayware]
Policy type. Policy type anomaly is read-only.
policyUpi string
Policy UPI
recommendation string
Remediation recommendation
remediable boolean
isRemediable
remediation object
Model for Remediation
actions object[]
Policy Action
Array [
operation string
payload string
]
cliScriptTemplate string
CLI Script Template
description string
Description
restrictAlertDismissal boolean
Restrict alert dismissal
rule objectrequired
Model for Rule
apiName string
API name
cloudAccount string
Cloud account
cloudType string
Cloud type
criteria stringrequired
Saved search ID that defines the rule criteria.
dataCriteria object
Criteria for Rule
classificationResult string
Data policy. Required for DLP rule criteria.
exposure string
Possible values: [private, public, conditional]
File exposure
extension string[]
File extensions
name stringrequired
Name
parameters objectrequired
Parameters (e.g. {"savedSearch": "true"})
property name* string
resourceIdPath string
Resource ID path
resourceType string
Resource type
type stringrequired
Possible values: [Config, Network, AuditEvent, DLP, IAM, NetworkConfig]
Type of rule or RQL query
ruleLastModifiedOn int64
Rule last modified on
severity stringrequired
Possible values: [high, medium, low]
Severity
systemDefault boolean
true = Policy is a Prisma Cloud system default policy
policyId string
Policy ID
reason string
The reason for an alert's status. For more information on Alert reasons see View and Respond to Prisma Cloud Alerts and Prisma Cloud Alert Resolution Reasons
resource object
Model for Cloud Resource
account string
Account
accountId string
Account ID
additionalInfo object
Additional info
array boolean
bigDecimal boolean
bigInteger boolean
binary boolean
boolean boolean
containerNode boolean
double boolean
float boolean
floatingPointNumber boolean
int boolean
integralNumber boolean
long boolean
missingNode boolean
nodeType string
Possible values: [ARRAY, BINARY, BOOLEAN, MISSING, NULL, NUMBER, OBJECT, POJO, STRING]
null boolean
number boolean
object boolean
pojo boolean
short boolean
textual boolean
valueNode boolean
cloudAccountAncestors string[]
Cloud account ancestors. For GCP.
cloudAccountGroups string[]
Cloud account groups
cloudAccountOwners string[]
Cloud account owners. For Azure and GCP.
cloudServiceName string
Cloud service name
cloudType string
Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]
Cloud type
data object
Raw JSON data for the resource
id string
Id
name string
Name
region string
Region name
regionId string
Region API identifier
resourceApiName string
Resource API name
resourceConfigJsonAvailable boolean
resourceDetailsAvailable boolean
resourceTags object
Resource tags
property name* string
resourceType string
Resource type
rrn string
RRN
unifiedAssetId string
url string
URL
riskDetail object
Model for Risk Detail
policyScores object[]
Array [
cloudType string
Possible values: [ALL, AWS, AZURE, GCP, ALIBABA_CLOUD, OCI, IBM]
Cloud type (Required for config policies). Not case-sensitive. Default is ALL.
complianceMetadata object[]
List of compliance data. Each item has compliance standard, requirement, and/or section information.
Array [
complianceId string
Compliance Section UUID
customAssigned boolean
policyId string
Policy ID
requirementDescription string
Requirement description
requirementId string
Requirement ID
requirementName string
Requirement name
sectionDescription string
Section name
sectionId string
Section Id
sectionLabel string
Section Label
standardDescription string
Compliance standard description
standardId string
standardName string
Compliance standard name
]
createdBy string
Created by
createdOn int64
Created on this timestamp
deleted boolean
Deleted
description string
Policy description
enabled boolean
true=enabled. false=disabled.
findingTypes string[]
Finding Type
labels string[]
Labels
lastModifiedBy string
Last modified by
lastModifiedOn int64
Last modified on this timestamp
name stringrequired
Policy name
overridden boolean
Overridden
points string
Points
policyId string
Policy ID
policySubTypes string[]
Possible values: [run, build, run_and_build, audit, data_classification, dns, malware, network_event, network, ueba, permissions, network_config, identity, sensitive_data_exposure, internet_exposure, injections, vulnerability_scanning, shellshock, known_bots, unknown_bots, virtual_patches, event, misconfig_and_event, misconfig, host, container_image]
Policy subtype
policyType stringrequired
Possible values: [config, network, audit_event, anomaly, data, iam, workload_vulnerability, workload_incident, api, attack_path, malware, grayware]
Policy type. Policy type anomaly is read-only.
policyUpi string
Policy UPI
recommendation string
Remediation recommendation
remediable boolean
isRemediable
remediation object
Model for Remediation
actions object[]
Policy Action
Array [
operation string
payload string
]
cliScriptTemplate string
CLI Script Template
description string
Description
restrictAlertDismissal boolean
Restrict alert dismissal
riskScore object
Model for Score
maxScore int64
Max Score
score int64
Score
rule objectrequired
Model for Rule
apiName string
API name
cloudAccount string
Cloud account
cloudType string
Cloud type
criteria stringrequired
Saved search ID that defines the rule criteria.
dataCriteria object
Criteria for Rule
classificationResult string
Data policy. Required for DLP rule criteria.
exposure string
Possible values: [private, public, conditional]
File exposure
extension string[]
File extensions
name stringrequired
Name
parameters objectrequired
Parameters (e.g. {"savedSearch": "true"})
property name* string
resourceIdPath string
Resource ID path
resourceType string
Resource type
type stringrequired
Possible values: [Config, Network, AuditEvent, DLP, IAM, NetworkConfig]
Type of rule or RQL query
ruleLastModifiedOn int64
Rule last modified on
severity stringrequired
Possible values: [high, medium, low]
Severity
systemDefault boolean
true = Policy is a Prisma Cloud system default policy
]
rating string
Rating
riskScore object
Model for Score
maxScore int64
Max Score
score int64
Score
score string
Score
saveSearchId string
Saved Search ID
status string
Possible values: [open, dismissed, snoozed, resolved, pending_resolution]
Status
triggeredBy string
Triggered By
]
nextPageToken string
sortAllowedColumns string[]
totalRows int64

Example (from schema)

{
  "dynamicColumns": [
    "string"
  ],
  "infoMsg": "string",
  "items": [
    {
      "alertAdditionalInfo": {},
      "alertAttribution": {
        "attributionEventList": [
          {
            "event": "string",
            "event_ts": 0,
            "username": "string"
          }
        ],
        "resourceCreatedBy": "string",
        "resourceCreatedOn": 0
      },
      "alertCount": 0,
      "alertRules": [
        {
          "alertRuleNotificationConfig": [
            {
              "dayOfMonth": 0,
              "daysOfWeek": [
                {
                  "day": "SU",
                  "offset": 0
                }
              ],
              "detailedReport": true,
              "enabled": true,
              "frequency": "as_it_happens",
              "frequencyFromRRule": "string",
              "hourOfDay": 0,
              "id": "string",
              "includeRemediation": true,
              "lastUpdated": 0,
              "last_sent_ts": 0,
              "recipients": [
                "string"
              ],
              "rruleSchedule": "string",
              "templateId": "string",
              "timezone": "string",
              "type": "email",
              "withCompression": true
            }
          ],
          "allowAutoRemediate": true,
          "delayNotificationMs": 0,
          "description": "string",
          "enabled": true,
          "lastModifiedBy": "string",
          "lastModifiedOn": 0,
          "name": "string",
          "notifyOnDismissed": true,
          "notifyOnOpen": true,
          "notifyOnResolved": true,
          "notifyOnSnoozed": true,
          "policies": [
            "string"
          ],
          "policyLabels": [
            "string"
          ],
          "policyScanConfigId": "string",
          "scanAll": true,
          "target": {
            "accountGroups": [
              "string"
            ],
            "alertRulePolicyFilter": {
              "availablePolicyFilters": [
                "string"
              ],
              "cloud.type": [
                "ALL"
              ],
              "policy.complianceStandard": [
                "string"
              ],
              "policy.label": [
                "string"
              ],
              "policy.severity": [
                "string"
              ]
            },
            "excludedAccounts": [
              "string"
            ],
            "includedResourceLists": {
              "computeAccessGroupIds": [
                "string"
              ]
            },
            "regions": [
              "string"
            ],
            "tags": [
              {
                "key": "string",
                "values": [
                  "string"
                ]
              }
            ]
          }
        }
      ],
      "alertTime": 0,
      "appMetadata": [
        {}
      ],
      "connectionDetails": [
        {
          "accepted": "string",
          "accountName": "string",
          "classification": "string",
          "destIp": "string",
          "destIsp": "string",
          "feedSource": "string",
          "id": 0,
          "inboundTrafficVolume": 0,
          "markedThreatTs": 0,
          "outboundTrafficVolume": 0,
          "packets": 0,
          "srcIp": "string",
          "srcIsp": "string",
          "threatDescription": "string",
          "timestamp": 0,
          "trafficOverTime": [
            {}
          ],
          "trafficVolume": 0
        }
      ],
      "dismissalDuration": "string",
      "dismissalNote": "string",
      "dismissalUntilTs": 0,
      "dismissedBy": "string",
      "eventOccurred": 0,
      "firstSeen": 0,
      "history": [
        {
          "reason": "string",
          "status": "OPEN"
        }
      ],
      "id": "string",
      "investigateOptions": {
        "alertId": "string",
        "hasSearchExecutionSupport": true,
        "searchId": "string"
      },
      "lastSeen": 0,
      "lastUpdated": 0,
      "metadata": {},
      "policy": {
        "cloudType": "ALL",
        "complianceMetadata": [
          {
            "complianceId": "string",
            "customAssigned": true,
            "policyId": "string",
            "requirementDescription": "string",
            "requirementId": "string",
            "requirementName": "string",
            "sectionDescription": "string",
            "sectionId": "string",
            "sectionLabel": "string",
            "standardDescription": "string",
            "standardId": "string",
            "standardName": "string"
          }
        ],
        "createdBy": "string",
        "createdOn": 0,
        "deleted": true,
        "description": "string",
        "enabled": true,
        "findingTypes": [
          "string"
        ],
        "labels": [
          "string"
        ],
        "lastModifiedBy": "string",
        "lastModifiedOn": 0,
        "name": "string",
        "overridden": true,
        "policyId": "string",
        "policySubTypes": [
          "run"
        ],
        "policyType": "config",
        "policyUpi": "string",
        "recommendation": "string",
        "remediable": true,
        "remediation": {
          "actions": [
            {
              "operation": "string",
              "payload": "string"
            }
          ],
          "cliScriptTemplate": "string",
          "description": "string"
        },
        "restrictAlertDismissal": true,
        "rule": {
          "apiName": "string",
          "cloudAccount": "string",
          "cloudType": "string",
          "criteria": "string",
          "dataCriteria": {
            "classificationResult": "string",
            "exposure": "private",
            "extension": [
              "string"
            ]
          },
          "name": "string",
          "parameters": {},
          "resourceIdPath": "string",
          "resourceType": "string",
          "type": "Config"
        },
        "ruleLastModifiedOn": 0,
        "severity": "high",
        "systemDefault": true
      },
      "policyId": "string",
      "reason": "string",
      "resource": {
        "account": "string",
        "accountId": "string",
        "additionalInfo": {
          "array": true,
          "bigDecimal": true,
          "bigInteger": true,
          "binary": true,
          "boolean": true,
          "containerNode": true,
          "double": true,
          "float": true,
          "floatingPointNumber": true,
          "int": true,
          "integralNumber": true,
          "long": true,
          "missingNode": true,
          "nodeType": "ARRAY",
          "null": true,
          "number": true,
          "object": true,
          "pojo": true,
          "short": true,
          "textual": true,
          "valueNode": true
        },
        "cloudAccountAncestors": [
          "string"
        ],
        "cloudAccountGroups": [
          "string"
        ],
        "cloudAccountOwners": [
          "string"
        ],
        "cloudServiceName": "string",
        "cloudType": "ALL",
        "data": {},
        "id": "string",
        "name": "string",
        "region": "string",
        "regionId": "string",
        "resourceApiName": "string",
        "resourceConfigJsonAvailable": true,
        "resourceDetailsAvailable": true,
        "resourceTags": {},
        "resourceType": "string",
        "rrn": "string",
        "unifiedAssetId": "string",
        "url": "string"
      },
      "riskDetail": {
        "policyScores": [
          {
            "cloudType": "ALL",
            "complianceMetadata": [
              {
                "complianceId": "string",
                "customAssigned": true,
                "policyId": "string",
                "requirementDescription": "string",
                "requirementId": "string",
                "requirementName": "string",
                "sectionDescription": "string",
                "sectionId": "string",
                "sectionLabel": "string",
                "standardDescription": "string",
                "standardId": "string",
                "standardName": "string"
              }
            ],
            "createdBy": "string",
            "createdOn": 0,
            "deleted": true,
            "description": "string",
            "enabled": true,
            "findingTypes": [
              "string"
            ],
            "labels": [
              "string"
            ],
            "lastModifiedBy": "string",
            "lastModifiedOn": 0,
            "name": "string",
            "overridden": true,
            "points": "string",
            "policyId": "string",
            "policySubTypes": [
              "run"
            ],
            "policyType": "config",
            "policyUpi": "string",
            "recommendation": "string",
            "remediable": true,
            "remediation": {
              "actions": [
                {
                  "operation": "string",
                  "payload": "string"
                }
              ],
              "cliScriptTemplate": "string",
              "description": "string"
            },
            "restrictAlertDismissal": true,
            "riskScore": {
              "maxScore": 0,
              "score": 0
            },
            "rule": {
              "apiName": "string",
              "cloudAccount": "string",
              "cloudType": "string",
              "criteria": "string",
              "dataCriteria": {
                "classificationResult": "string",
                "exposure": "private",
                "extension": [
                  "string"
                ]
              },
              "name": "string",
              "parameters": {},
              "resourceIdPath": "string",
              "resourceType": "string",
              "type": "Config"
            },
            "ruleLastModifiedOn": 0,
            "severity": "high",
            "systemDefault": true
          }
        ],
        "rating": "string",
        "riskScore": {
          "maxScore": 0,
          "score": 0
        },
        "score": "string"
      },
      "saveSearchId": "string",
      "status": "open",
      "triggeredBy": "string"
    }
  ],
  "nextPageToken": "string",
  "sortAllowedColumns": [
    "string"
  ],
  "totalRows": 0
}

400

internal_error

429

Too Many Requests

Loading...