Returns a paginated list of alerts matching the given filters. Only alerts that have completed Auto Triage (i.e. have an assigned verdict) are returned; alerts still being processed are omitted. To fetch an alert regardless of its triage state, use Retrieve alert (GetAlert).
Contains all available filter criteria for listing alerts. All filters are combined with AND logic. Multiple values within a single filter are combined with OR logic.
The verdict values to filter by. Accepted values: "True Positive - Malicious", "True Positive - Benign", "False Positive".
The triage severities to filter by. Accepted values: "Info", "Low", "Medium", "High", "Critical".
The alert source type IDs to filter by. For example, "crowdstrike_streaming", "sentinelone_data_connector".
The timestamp after which alerts were acknowledged. If neither acknowledged_after nor acknowledged_before is set, results default to the last 7 days. If only acknowledged_before is set, acknowledged_after defaults to 90 days before it, which is the maximum lookback.
The timestamp before which alerts were acknowledged. If neither acknowledged_after nor acknowledged_before is set, results default to the last 7 days. If only acknowledged_after is set, acknowledged_before defaults to now.
The analyst verdict feedback actions to filter by, accepted values: "Confirmed", "Changed", "None".
The case states to filter by. Default states: "New", "In Progress", "On Hold", "Resolved", "Closed". Custom case states defined in Case Management are also accepted.
Note: case data (this filter and case_closed_by, has_case_created below, and the case_created field on the alert) is synchronized from Case Management asynchronously. A recent case creation, closure, or state change may not be reflected here immediately.
The case closed-by values to filter by. Accepted values: "Analyst", "Workflow", "Socrates".
When true, returns only alerts that have an associated case; when false, only alerts without one.
The MITRE ATT&CK tactic codes to filter by. For example, "TA0001", "TA0002". Alerts matching any of the specified tactics are returned.
The alert categories to filter by. Accepted values: "Endpoint Security", "Identity and Access", "Cloud Security", "Data Security", "Email Security", "General". Alerts matching any of the specified categories are returned.
The observable IDs to filter by. Each value is an observable ID from the alert response. Alerts containing any of the specified observables are returned. Useful for pivoting from an observable to its related alerts.
The case IDs to filter by. Each value is a case pretty ID from the case_created.id field. Alerts linked to any of the specified cases are returned. Distinct from has_case_created, which only filters on the presence or absence of a case.
Note: Like other case fields, this is synchronized from Case Management asynchronously. Recent case creation or deletion may not be reflected here immediately.
The maximum number of alerts to retrieve per page. Default is 50. Maximum is 100. If the number of results exceeds the defined page size, use pagination to retrieve the next page by making an identical List alerts request and providing the page token from the previous response.
The token received from a previous List alerts response. Provide this to retrieve the next page of results.
The sort direction. Accepted values: "asc", "desc". Default: "desc".
The field to sort by. Accepted values: "acknowledged_at", "name", "verdict_triage_severity", "verdict_value". Default: "acknowledged_at". When text_search is set, results sort by relevance unless order_by is explicitly provided.
An optional free-text search query. Searches across alert ID, name, summary, verdict justification, observables, MITRE tactics and techniques, and related case ID.
Note: text search is backed by a search index that is updated asynchronously. Newly ingested or recently updated alerts may not be reflected in text_search results for a short period after the change.
A successful response.
The alerts matching the filter criteria.
A condensed representation of an alert for list responses. It contains only list-relevant fields. Use Retrieve alert (GetAlert) to fetch full details.
The unique identifier of the alert.
The unique identifier of the alert as displayed on the Alerts page.
The identifier of the organization.
The identifier of the workspace.
The alert name.
The type of alert. For example, "Endpoint Detection - ldt".
Contains information from the source security system that generated the alert.
The alert source vendor name. Deprecated: use integration_type_id instead.
A link to the alert in the source system console.
The severity from the source system. For example, "Critical", "High", "Medium", "Low", "Informational".
The mitigation action taken or available from the source system.
The timestamp when the alert was detected by the source system.
The alert source type identifier. For example, "crowdstrike_streaming", "sentinelone_data_connector".
The timestamp when the alert was acknowledged by Auto Triage.
The timestamp when Auto Triage completed the verdict assignment.
The timestamp when the alert was ingested into the workspace.
The triage verdict, severity, and confidence assigned by Auto Triage.
The verdict value. Possible values: "True Positive - Malicious", "True Positive - Benign", "False Positive".
The severity assigned by Auto Triage. Possible values: "Critical", "High", "Medium", "Low", "Info".
The Auto Triage's confidence level in the verdict. Possible values: "High", "Medium", "Low".
Contains MITRE ATT&CK framework mappings.
The MITRE ATT&CK tactics associated with the alert.
A MITRE ATT&CK tactic.
The MITRE ATT&CK tactic ID. For example, "TA0011".
The tactic name.
A link to the MITRE ATT&CK tactic page.
The MITRE ATT&CK techniques associated with the alert.
A MITRE ATT&CK technique.
The MITRE ATT&CK technique ID. For example, "T1219", "T1059.004".
The technique name.
A link to the MITRE ATT&CK technique page.
Contains information about the case associated with this alert.
The case pretty ID.
A link to the case in Torq.
The entity that performed the action.
The actor kind. Identifies which actor case is populated. One of:
USER, WORKFLOW, INTEGRATION, SERVICE_API_KEY, SOCRATES, TRIAGE, AGENT, BUILDER.
User identity information.
The actor's email address.
The user's full name.
Workflow execution details.
The workflow ID.
The workflow execution ID.
The workflow name.
Integration configuration.
The integration ID.
The integration type identifier.
Service account API token information.
The service account API token name.
The service account API token client ID.
Original actor information.
The entity that performed the action.
Triage system action.
Agent execution details.
The agent ID.
The agent execution ID.
Workflow Builder acting on behalf of a user.
The entity that performed the action.
Contains the manual verification status set by an analyst.
The verdict review action taken. Possible values: "Confirmed", "Changed".
The email address of the analyst who reviewed the verdict.
The timestamp when the verdict was reviewed.
Verdict and/or severity changes.
The new severity if changed. Possible values: "Critical", "High", "Medium", "Low", "Info". Empty if unchanged.
The new verdict if changed. Possible values: "True Positive - Malicious", "True Positive - Benign", "False Positive". Empty if unchanged.
The analyst's comment on the verdict review.
The security categories assigned to the alert, ordered by dominance — the first element is the primary category. Always has at least one value. Possible values: "Endpoint Security", "Identity and Access", "Cloud Security", "Data Security", "Email Security", "General". For natively supported sources the categories follow from the detection type; for universal sources Auto Triage classifies them.
When a token is returned, it indicates there is another page of results to retrieve. Pass this token as the page_token parameter in a subsequent List alerts request. If this field is empty, there are no additional pages to retrieve.
Invalid bearer token. If you receive this message more than once try creating a new Client ID/Client Secret or generating a new bearer token.
You don't have permission to access this resource.