---
title: "Search Alert Rules"
method: POST
path: "/api/v2/AlertRules/search"
tags: ["AlertRules"]
---

# Search Alert Rules

`POST /api/v2/AlertRules/search`

Search alert rules by invoking the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/AlertRules/search`

 To limit the returned result, optionally specify one or more filters in the request body. For more information about using filters, see the [Simple & Advanced Search section](/api/v2/docs/#tag/OVERVIEW). 

  Here are some example `body` payloads:

  * `{ "filters": [ { "field": "mcGuid", "expression": "rlike", "value": "123ABC" } ] } ` 

  * `{ "filters": [ { "field": "mcGuid", "expression": "between", "values": [ "ABC_123", "DEC_456" ] } ] }` 

  * `{ "filters": [ { "field": "intgGuidList", "expression": "eq", "value": "ABC_123" } ] } ` 

  * `{ "filters": [ { "field": "intgGuidList", "expression": "in", "values": [ "ABC_123", "DEF_456" ] } ] } ` 

  * `{ "filters": [ { "field": "filters.name", "expression": "ilike", "value": "slack" } ] } ` 

  * `{ "filters": [ { "field": "filters.resourceGroups", "expression": "eq", "value": "ABC_123" } ] } ` 

  * `{ "filters": [ { "field": "filters.severity", "expression": "eq", "value": "5" } ] } ` 

  * `{ "filters": [ { "field": "filters.eventCategory", "expression": "eq", "value": "App" } ] } ` 

  * `{ "filters": [ { "field": "reportNotificationTypes.agentEvents", "expression": "eq", "value": "false" } ] } ` 

  In the request body, optionally specify the list of fields to return in the response by specifying the list in the `returns` array.

## Headers

- `Authorization` string, required
- `Content-Type` string, required
- `Org-Access` boolean
- `Account-Name` string

## Request body

- GETDATAREQUESTBODYFILTERS
  - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match.
    - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'not_rlike' | 'rlike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition.
    - `field` string, required — The name of the data field to which the condition applies.
    - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value.
    - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values.
  - `returns` string[] — Use this attribute to specify which top-level fields of the response schema you want to receive.

## Response `200`

No Error (List of Alert Rules)

- object
  - `data` AlertRulesResponseSchema[]
    - `filters` object, required — When sending a request, use this object to define the new alert rule. When included in a response, this object contains details of an alert rule. You can use these attributes when searching for existing alert rules by invoking a GET request.
      - `name` string, required — The alert rule's name.
      - `description` string — Summary of the alert rule.
      - `enabled` unknown, required
      - `resourceGroups` string[] — (Account-Only) The resource groups that you want the rule to apply to, identified by `resourceGuid`. You can get the `resourceGuid` for a resource group using the [Resource Groups](#tag/ResourceGroups) endpoint.
      - `laceworkAccounts` string[] — (Organization-Only) The lacework accounts that you want the rule to apply to, identified by the lacework account name.
      - `eventCategory` string[] — The event categories that you want the rule to apply to. This field is deprecated. Use the `subCategory` field instead.
      - `source` string[] — The alert sources that will use this rule for alert routing.
      - `sources` string[] — The alert sources that will use this rule for alert routing.
      - `category` string[] — The alert categories that will use this rule for alert routing.
      - `subCategory` string[] — The subcategories that you want the rule to apply to.
      - `severity` unknown[], required — The severity levels that you want the rule to apply to, where 1 = Critical, 2 = High, 3 = Medium, 4 = Low, and 5 = Info.
        - unknown
    - `intgGuidList` string[], required — The alert channels for the rule to access.
    - `type` 'Event', required — The alert type.
    - `mcGuid` string — Alert Rule ID

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)