Returns a paginated, reverse-chronological list of history events for an alert.
The ID of the alert to retrieve history for. This property is required.
The maximum number of history events to retrieve per page. Default is 50. Maximum is 100. If the number of results exceeds the defined page size, use pagination to retrieve the next page by making an identical List alert history request and providing the page token from the previous response.
The token received from a previous List alert history response. Provide this to retrieve the next page of results.
A successful response.
The history events in reverse-chronological order.
A single event in an alert's history. Exactly one details field is set, identifying the event type.
The unique identifier of the history event.
The identifier of the alert this event belongs to.
The timestamp when the event occurred.
The entity that performed the action.
The actor kind. Identifies which actor case is populated. One of:
USER, WORKFLOW, INTEGRATION, SERVICE_API_KEY, SOCRATES, TRIAGE, AGENT, BUILDER.
User identity information.
The actor's email address.
The user's full name.
Workflow execution details.
The workflow ID.
The workflow execution ID.
The workflow name.
Integration configuration.
The integration ID.
The integration type identifier.
Service account API token information.
The service account API token name.
The service account API token client ID.
Original actor information.
The entity that performed the action.
Triage system action.
Agent execution details.
The agent ID.
The agent execution ID.
Workflow Builder acting on behalf of a user.
The entity that performed the action.
The event type, which identifies which details field is populated. One of: "alert_created", "enrichment_completed", "triage_completed", "verdict_set", "verdict_confirmed", "verdict_changed", "severity_changed", "verdict_review_undone", "case_created", "case_closed", "case_deleted".
Details of an alert_created event.
Details of an enrichment_completed event.
The enrichment label. For example, "Threat Intelligence", "MITRE ATT&CK", "Case History", "Organizational Context".
Details of a triage_completed event.
Details of a verdict_set event.
The verdict value assigned by Auto Triage.
Details of a verdict_confirmed event.
The confirmed verdict.
The analyst comment provided with the confirmation.
Details of a verdict_changed event.
The verdict before the change.
The verdict after the change.
The analyst comment provided with the change.
Details of a severity_changed event.
The severity before the change.
The severity after the change.
The analyst comment provided with the change.
Details of a verdict_review_undone event.
The verdict that was in effect before the review was undone.
The Auto Triage verdict restored after the review was undone.
Details of a case_created event.
The case identifier as displayed on the Cases page.
Details of a case_closed event.
The case identifier as displayed on the Cases page.
The reason the case was closed.
Details of a case_deleted event.
The case identifier as displayed on the Cases page.
When a token is returned, it indicates there is another page of results to retrieve. Pass this token as the page_token parameter in a subsequent List alert history request. If this field is empty, there are no additional pages to retrieve.
Invalid bearer token. If you receive this message more than once try creating a new Client ID/Client Secret or generating a new bearer token.
You don't have permission to access this resource.