---
title: "Alert Entities"
method: GET
path: "/api/v2/Alerts/Entities/{alertId}"
tags: ["Alerts"]
---

# Alert Entities

`GET /api/v2/Alerts/Entities/{alertId}`

List all entities associated with a given alert ID for which additional context is available. The entity can be any non-compliant resource, such as a machine or IP address.

## Path parameters

- `alertId` string, required

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Response `200`

No Error (Alert Entities)

- AlertsEntitiesResponseSchemaFinalized
  - `data` object[]
    - `entities` union
      - AlertsIPEntitySummaryResponseSchemaFinalized
        - `contextEntityType` 'IpAddress' — This field is used for the response schema option; it will not be in the response.
        - `entityValue` string — The identifying value for the entity, that is, its IpAddress.
        - `inBytes` number — Total number of bytes received from external IP addresses.
        - `outBytes` number — Total number of bytes sent to external IP addresses.
        - `country` string — Country name associated with the IP address.
        - `region` string — Region name associated with the IP address.
        - `ports` string[] — Array of ports associated with the IP address.
        - `sources` object[]
          - `date` string — Date of the finding that this IP address is malicious.
          - `primary_threat_tag` string — The primary threat tag assigned to this finding by the security vendor who marked this IP address as malicious.
          - `source` string — The security vendor who marked this IP address as malicious.
          - `tag1` string — Tag associated with this finding.
      - AlertsMachineEntitySummaryResponseSchemaFinalized
        - `contextEntityType` 'Machine' — This field is used for the response schema option; it will not be in the response.
        - `entityValue` string — The identifying value for the entity, that is, its machine identifier (MID).
        - `externalIp` string — The external IP address of this machine, if any.
        - `cpuPercentage` number — The percentage of CPU used
        - `internalIp` string — Internal IP address of the machine.
        - `isExternal` boolean — Whether this is an external machine.
        - `hostname` string — Hostname associated to the machine
    - `countOfEntities` number — Count of entities that have additional context for the given alert ID.

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)