AlertsDataQuery

Types

Provides alert analytics including top threat event types, impacted systems, alert summaries, and alert overview details.

Fields

Name	Description
alert_overview_page(start_time: Long!, end_time: Long!, alert_id: Long!) - AlertOverviewPageResponse	Detailed alert overview for a specific alert. Returns comprehensive information including policy, event type, transaction counts, bytes, duration, file details, destination IP, application info, and more.
alert_summary(start_time: Long!, end_time: Long!, filter_by: [AlertSummaryPageFilterBy], having_filter: [AlertSummaryPageHavingFilter], order_by: [AlertSummaryPageOrderBy], limit: Int, offset: Int) - AlertSummaryPageResponse	Alert summary with filtering, having, and ordering support. Returns alert details including threat key, event type, duration, and transaction counts.

EXAMPLE

{
"alert_overview_page": {
  "entries": [{
    "alert_id": 123,
    "policy": 123,
    "event_type": 123,
    "event_type_name": "example",
    "first_known_attempt": 123,
    "last_known_attempt": 123,
    "allowed_transactions": 123,
    "total_transactions": 123,
    "allowed_bytes": 123,
    "total_bytes": 123,
    "duration": 123,
    "status": "example",
    "file_name": "example",
    "file_type": 123,
    "ba_md5": "example",
    "sha256": "example",
    "ba_scan_info": 123,
    "destination_ip": 123,
    "app": 123,
    "application_category": 123,
    "ssl_scan_info": "example",
    "host_name": "example",
    "url_category": 123
  }]
},
"alert_summary": {
  "entries": [{
    "threat_key": "example",
    "alert_id": 123,
    "event_type": 123,
    "event_type_name": "example",
    "impacted_systems": 123,
    "status": "example",
    "duration": 123,
    "last_known_attempt": 123,
    "transactions": 123,
    "first_known_attempt": 123,
    "alert_rule": 123
  }]
}
}