---
title: "Alert Rule Details"
method: GET
path: "/api/v2/AlertRules/{mcGuid}"
tags: ["AlertRules"]
---

# Alert Rule Details

`GET /api/v2/AlertRules/{mcGuid}`

Get details about an alert rule by invoking the following endpoint:

  > `GET https://YourAccount.lacework.net/api/v2/AlertRules/{mcGuid}`

  Replace `{mcGuid}` with the `mcGuid` value returned for an alert rule in the response when the `GET /api/v2/AlertRules` endpoint is invoked.

## Path parameters

- `mcGuid` string, required

## Headers

- `Authorization` string, required
- `Content-Type` string, required
- `Org-Access` boolean
- `Account-Name` string

## Response `200`

No Error

- object
  - `data` AlertRulesResponseSchema
    - `filters` object, required — When sending a request, use this object to define the new alert rule. When included in a response, this object contains details of an alert rule. You can use these attributes when searching for existing alert rules by invoking a GET request.
      - `name` string, required — The alert rule's name.
      - `description` string — Summary of the alert rule.
      - `enabled` unknown, required
      - `resourceGroups` string[] — (Account-Only) The resource groups that you want the rule to apply to, identified by `resourceGuid`. You can get the `resourceGuid` for a resource group using the [Resource Groups](#tag/ResourceGroups) endpoint.
      - `laceworkAccounts` string[] — (Organization-Only) The lacework accounts that you want the rule to apply to, identified by the lacework account name.
      - `eventCategory` string[] — The event categories that you want the rule to apply to. This field is deprecated. Use the `subCategory` field instead.
      - `source` string[] — The alert sources that will use this rule for alert routing.
      - `sources` string[] — The alert sources that will use this rule for alert routing.
      - `category` string[] — The alert categories that will use this rule for alert routing.
      - `subCategory` string[] — The subcategories that you want the rule to apply to.
      - `severity` unknown[], required — The severity levels that you want the rule to apply to, where 1 = Critical, 2 = High, 3 = Medium, 4 = Low, and 5 = Info.
        - unknown
    - `intgGuidList` string[], required — The alert channels for the rule to access.
    - `type` 'Event', required — The alert type.
    - `mcGuid` string — Alert Rule ID

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/versions/7015f76895f2/schema)