Sign in

v1

latestOpenAPI 3.1.02026-07-26363186558.0 KB
DTM Alerts

List child alerts for a given aggregated alert bucket

get/alerts/{id}/aggregates

Path parameters

idstring required
Example:c4huif0mhcmiku5g7jsg

The ID of the alert bucket to list child aggregate alerts for.

Query parameters

sort'id' | 'created_at' | 'updated_at' | 'monitor_id'
Example:updated_at

The alert field name to sort the response alerts by.

order'asc' | 'desc'
Example:asc

The order used to sort the response alerts field by.

sizeinteger
Example:20

The number of alerts to return in each page. Max value of 25.

monitor_idstring
Example:c4fcpm2bqsiatib6i4h0

Only return alerts for the given monitor ID. This parameter can be specified multiple times to filter on more than one monitor ID.

refsboolean

If false, doc, labels, and topics are not returned in the response body.

replace_linksboolean

If true, then any links in the alert doc are sanitized and replaced.

monitor_nameboolean

If true, then the monitor's name that created the alert is returned in the alert response body.

has_analysisboolean

If true, then only alerts that have analysis are returned. An alert has anlysis if it has either analysis text or analysis file attachments.

bucketsboolean

If true, then alert buckets are returned for aggregated alerts. If false, then bucket format is not returned, but instead all child aggregated alerts are.

sincestring date-time

When listing alerts by date range, since defines the starting date in RFC3339 format

untilstring date-time

When listing alerts by date range, until defines the ending date in RFC3339 format

pagestring

Only used when fetching subsequent pages during pagination and will contain a unique page ID. No other query parameters can be used with page

truncateinteger

Truncates document fields to the given length using unicode ellipsis (\x2026) to indicate truncation

status'new' | 'read' | 'escalated' | 'in_progress' | 'closed' | 'no_action_required' | 'duplicate' | 'not_relevant' | 'tracked_external'

Filter alerts by their status. This parameter can be specified multiple times.

alert_type'Compromised Credentials' | 'Domain Discovery' | 'Forum Post' | 'Message' | 'Paste' | 'Shop Listing' | 'Tweet' | 'Web Content'

Filter alerts by alert type. This parameter can be specified multiple times.

searchstring

Search alert and triggering doc contents based on a simple Lucene query string including 1 or more text values separated by AND or OR.

match_valuestring

If specified, then only alerts that have the given match value are returned. This parameter can be repeated multiple times.

tagsstring

Filter alerts by tag(s). This parameter can be used more than once to filter on multiple tags.

search_encoding'base64'

When using the search parameter, its value can be base64 encoded in which case search_encoding indicates the value encoding type.

severity'high' | 'medium' | 'low'

Return alerts that have the given severity. This parameter can be repeated multiple times.

sanitizestring

If true, any HTML content in the alert is sanitized to ensure it does not potentially contain malicious tags. If not used, be careful when rendering/using the alert/doc content. This param can also be specified as a json path in the alert document to sanitize and may be repeated in this case.

mscore_gteinteger

Filter alerts with mscores greater than or equal to the given value.

Headers

x-apikeystring required

Your API key

Response

OK