Search Alert Rules
Search alert rules by invoking the following endpoint:
POST https://YourAccount.lacework.net/api/v2/AlertRules/search
To limit the returned result, optionally specify one or more filters in the request body. For more information about using filters, see the Simple & Advanced Search section.
Here are some example body payloads:
-
{ "filters": [ { "field": "mcGuid", "expression": "rlike", "value": "123ABC" } ] }
-
{ "filters": [ { "field": "mcGuid", "expression": "between", "values": [ "ABC_123", "DEC_456" ] } ] }
-
{ "filters": [ { "field": "intgGuidList", "expression": "eq", "value": "ABC_123" } ] }
-
{ "filters": [ { "field": "intgGuidList", "expression": "in", "values": [ "ABC_123", "DEF_456" ] } ] }
-
{ "filters": [ { "field": "filters.name", "expression": "ilike", "value": "slack" } ] }
-
{ "filters": [ { "field": "filters.resourceGroups", "expression": "eq", "value": "ABC_123" } ] }
-
{ "filters": [ { "field": "filters.severity", "expression": "eq", "value": "5" } ] }
-
{ "filters": [ { "field": "filters.eventCategory", "expression": "eq", "value": "App" } ] }
-
{ "filters": [ { "field": "reportNotificationTypes.agentEvents", "expression": "eq", "value": "false" } ] }
In the request body, optionally specify the list of fields to return in the response by specifying the list in the returns array.
Headers
Bearer Access Token. For example, "Bearer {YourAPIToken}"
application/json
Use this attribute to specify if the access token has organization admin permissions. If the access token has only account permissions, use the Account-Name attribute to specify which account to access.
Use this attribute to specify which sub-account to access.
Request body
Response
No Error (List of Alert Rules)
Example response
{
"data": [
{
"filters": {
"enabled": 1
}
}
]
}