--- title: "Search Alerts" method: POST path: "/api/v2/Alerts/search" tags: ["Alerts"] --- # Search Alerts `POST /api/v2/Alerts/search` Search alerts by invoking the following endpoint: > `POST https://YourAccount.lacework.net/api/v2/Alerts/search` Optionally specify filters in the request body. For more information about using filters, see the [Simple & Advanced Search section](/api/v2/docs/#tag/OVERVIEW). For the `timeFilter` filter, these are the supported time formats: * `yyyy-MM-dd` for example, `2022-07-08` * `yyyy-MM-ddTHH` for example, `2022-07-08T08` * `yyyy-MM-ddTHH:mm:ssZ` for example, `2022-07-08T08:00:00Z` * `yyyy-MM-ddTHH:mm:ss.SSSZ` for example, `2022-07-08T08:00:00.000Z` FortiCNAPP highly recommends specifying a time range. Without a specified time range, the request uses the default time range of 24 hours prior to the current time. The maximum time range per API request is 7 days. To use the current time as the end time, exclude the endTime field. To limit the returned result, optionally specify one or more filters in the request body. These fields can be set in the filters: `alertId`, `alertType`, `severity`, `status`, `subCategory`, `category`, and `source`. In the filter, specify the field on which to filter, the `eq` operator, and the value against which the field value is compared. You can optionally filter the returned alerts by one or more of the top-level fields. See [Filter Alerts](https://docs.fortinet.com/document/forticnapp/latest/administration-guide/600144/filter-alerts) for the filter values. Here are some example `body` payloads: * `{ "timeFilter": { "startTime": "2022-07-08T00:00:00Z", "endTime": "2022-07-08T08:00:00Z"},` `"filters": [ { "field": "alertType", "expression": "eq", "value": "SuspiciousUserFailedLogin" } ] }` * `{ "timeFilter": { "startTime": "2022-07-08T00:00:00Z", "endTime": "2022-07-08T08:00:00Z"},` `"filters": [ { "field": "severity", "expression": "eq", "value": "Critical" }, { "field": "status", "expression": "eq", "value": "Open" } ],` `"returns": [ "alertId", "alertName", "alertType", "alertInfo" ] }` Pagination metadata is located within the response's `paging` field, which contains information for `rows`, `totalRows`, and `urls`. The `urls` field contains the `nextPage` field with the Next Page URL. The Next Page URLs stay valid for 24 hours. To get the next page of the result, use the entire Next Page URL and send a GET request with the two required HTTP headers: "Authorization: Bearer {YourAPIToken}" and "Content-Type: application/json". Example: > `GET https://YourAccount.lacework.net/api/v2/Alerts/abcxyz123...` ## Headers - `Authorization` string, required - `Content-Type` string, required ## Request body - GETDATAREQUESTBODYTIMEFILTERSFORALERTS - `timeFilter` object — The date/time range during which actions occurred. - `startTime` string — Returns only recorded actions that occurred after this timestamp. - `endTime` string — Returns only recorded actions that occurred before this timestamp. If empty or missing, the current time is used. - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match. - `expression` 'eq', required — The comparison operator for the filter condition. - `field` 'alertId' | 'alertType' | 'severity' | 'status' | 'subCategory' | 'category' | 'source', required — The name of the data field to which the condition applies. - `value` string — The value that the condition checks for in the specified field. - `returns` string[] — Use this attribute to specify which top-level fields of the response schema you want to receive. ## Response `200` No Error (List of Alerts) - object - `paging` PagingSchema — Details of the response's pagination - `rows` number — The number of rows displayed on each page - `totalRows` number — The number of rows returned from the query - `urls` object — Pagination-related URLs - `nextPage` string — The next page's URL - `data` AlertsResponseSchema[] - `alertId` integer — Alert ID - `alertType` string — The alert type - `alertName` string — The alert name such as `Service called GCP API` - `alertInfo` object — Details of the alert - `description` string — The alert description provides why the potential threat occurred - `subject` string — The alert subject. In some cases, the alert subject can be the same as the alert name. - `customerCount` number — Number of customers with similar behavior. While this event occurred for the first time in this FortiCNAPP account, it may be considered less risky if it represents common behavior observed in other customer cloud deployments. - `isExpectedLWBehavior` boolean — Whether the alert results from activity related to your FortiCNAPP integration, such as connections between FortiCNAPP agents and the FortiCNAPP platform. - `supportingFacts` object[] — List of supporting facts of a [composite alert](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=INTRODUCTION_TO_COMPOSITE_ALERTS). - `supportingFactText` string — The supporting fact indicates why the potential threat occurred. - `subElements` object[] — Sub elements provide more details of supporting facts in a recursive format. - `severity` string — The alert's severity level. See [Alert Severity](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=ALERT_SEVERITY). - `internetExposure` string — Whether any entity involved in the alert is exposed to the internet: yes, no, or unknown. - `reachability` string — Whether any entity in the alert is reachable. - `derivedFields` object — The alert category, subcategory, and source. - `category` string — The alert category. See [Alert Categories](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=ALERT_CATEGORIES). - `subCategory` string — The alert subcategory. See [Alert Subcategories](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=ALERT_CATEGORIES#alert-subcategories). - `source` string — The origin of the alert: AWS, Azure, GCP, Agent, or K8s. - `startTime` string — The time and date when the potential threat started - `endTime` string — The time and date when the potential threat ended - `lastUserUpdatedTime` string — The timestamp for when a user selected a [primary integration](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=JIRA#bidirectional-integration) or updated the alert status - `status` string — The current status of the alert ## Other responses - `204` — No Data - `4XX` — Client Error - `5XX` — Internal Server Error --- [API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)