Get Alerts

Identifies the alert fields the filter is matching.

String that identifies the comparison operator you want to use for this filter. Possible values: - in— use with alert_id_list, alert_source, asm_alert_categories, case_id_list, business_units_list, cloud_management_status, tags, xpanse_policy_id, severity, integration_source - gte— Filters data from a specific timestamp onwards. Use with creation_time, first_observed, last_observed. - lte— Filters data up to a specific timestamp. Use with creation_time, first_observed, last_observed. - range— Filters data between two specific timestamps. Use with first_observed, last_observed. - relative_timestamp— Filters data relative to the current time (e.g., last 30 days). Use with first_observed, last_observed.

Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter: - alert_id_list — List of integers. Each item in the list must be an alert ID. - alert_source — List of strings. - asm_alert_categories — List of strings. Example values: "Development Infrastructure", "Unpatched, Misconfigured, and end-of-life (EOL) systems". - business_units_list — String or list of strings in the format "BU name" or "BU:BU name", for example “Acme & Co, Inc.” or “BU:Acme & Co, Inc.” - case_id_list — List of integers. Each item in the list must be a case ID. - cloud_management_status — String. Values are Managed Cloud, Unmanaged Cloud, and Not Applicable. - creation_time — Integer representing the number of seconds or milliseconds after the Unix epoch, UTC timezone. The value is returned in the response under the detection_timestamp field and represented in the console under the TIMESTAMP field. - external_id_list— List of strings representing external IDs. - first_observed — Values in milliseconds format - with gte or lte operator, specify a specific date or time as a timestamp in milliseconds format - with range operator, specify "to" and "from" values as timestamps in milliseconds format "value": { "from": "{{previous30Days}}","to": "{{previous7Days}}" - with relative_timestamp operator, specify time interval to look back on (24H, 7D, 30D, etc.) as a value in milliseconds format - integration_source — Valid values: AWS, AZURE, GOOGLE, PRISMA_CLOUD - last_observed — values in milliseconds format - with gte or lte operator, specify a specific date or time as a timestamp in milliseconds format - with range operator, specify "to" and "from" values as timestamps in milliseconds format, as follows "value": { "from": "{{previous30Days}}","to": "{{previous7Days}}" - with relative_timestamp operator, specify time interval to look back on (24H, 7D, 30D, etc.) as a value in milliseconds format - severity — Valid values: low, medium, high, critical, informational - status — Valid values: new, reopened, resolved_no_risk, resolved_risk_accepted, resolved_no_longer_observed, resolved_contested_asset, resolved_remediated_automatically, resolved, under_investigation. - tags — List of strings indicating the tags to filter on in the format "tag-family:tag-name", for example "AR:registered to you". - xpanse_policy_id — List of strings representing the xpanse policy IDs.