Alerts

REST API operations for alerts

Overview

The /alerts REST API operations are in open beta starting with Panther version 1.112, and are available to all customers. Please share any bug reports and feature requests with your Panther support team.

Use these API operations to interact with alerts in Panther.

To call the API, see the How to use the Panther REST API instructions—including directions for how to invoke it directly from this documentation page.

Required permissions

• For GET operations, your API token must have the Read Alerts permission.

• For PATCH operations, your API token must have the Manage Alerts permission.

Operations

Get an alert

get

Authorizations

Path parameters

idstringrequired

ID of the alert

Responses

application/json

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url 'https://your-api-host/alerts/{id}' \
  --header 'X-API-Key: YOUR_API_KEY'

200

400

404

200

{
  "assignee": {
    "id": "user",
    "type": "text"
  },
  "context": null,
  "createdAt": "text",
  "deliveries": [
    {
      "dispatchedAt": "text",
      "label": "text",
      "message": "text",
      "outputId": "text",
      "statusCode": 1,
      "success": true
    }
  ],
  "detection": {
    "id": "text",
    "type": "RULE"
  },
  "eventCount": 1,
  "firstEventOccurredAt": "text",
  "id": "text",
  "lastReceivedEventAt": "text",
  "runbook": "text",
  "severity": "CRITICAL",
  "status": "OPEN",
  "systemError": {
    "detection": {
      "id": "text",
      "type": "RULE"
    },
    "sourceId": "text",
    "sourceType": "text",
    "type": "text"
  },
  "title": "text",
  "type": "text",
  "updatedBy": {
    "id": "user",
    "type": "text"
  }
}

OK response.

Update the status or assignee of an alert

patch

Authorizations

Path parameters

idstringrequired

ID of the alert

Body

assigneestringoptional

The ID of the assignee for this alert

statusstring · enumoptional

The status of this Alert

Options: OPEN, CLOSED, TRIAGED, RESOLVED

Responses

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request PATCH \
  --url 'https://your-api-host/alerts/{id}' \
  --header 'X-API-Key: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "assignee": "text",
    "status": "OPEN"
  }'

200

400

404

200

No body

OK response.

List alerts

get

Authorizations

Query parameters

typestring · enum · default: "ALERT"optional

Options: ALERT, DETECTION_ERROR, SYSTEM_ERROR

sub-typestring · enum[]optional

The sub-type of the alert

cursorstringoptional

the pagination token

limitinteger · int64 · max: 50 · default: 25optional

the maximum results to return

created-afterstringoptional

The date and time after which the alerts were created. If empty we default to 30 days ago

Example: 1672531200

created-beforestringoptional

The date and time before which the alerts were created. If empty we default to the current time

Example: 1672531200

detection-idstringoptional

The detection ID to filter alerts by

sort-dirstring · enum · default: "desc"optional

The sort direction of the results

Options: asc, desc

name-containsstringoptional

A string to search for in the alert name

log-sourcestring[]optional

The log source of the alert

log-typestring[]optional

The log type of the alert

resource-typestring[]optional

The resource type of the alert

statusstring · enum[]optional

The status of the alert

severitystring · enum[]optional

The severity of the alert

assigneestring[]optional

The assignee of the alert. This should be a user id

event-count-mininteger · int64optional

The minimum number of events in the alert

event-count-maxinteger · int64optional

The maximum number of events in the alert

Responses

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url 'https://your-api-host/alerts' \
  --header 'X-API-Key: YOUR_API_KEY'

200

400

200

{
  "next": "text",
  "results": [
    {
      "assignee": {
        "id": "user",
        "type": "text"
      },
      "context": null,
      "createdAt": "text",
      "deliveries": [
        {
          "dispatchedAt": "text",
          "label": "text",
          "message": "text",
          "outputId": "text",
          "statusCode": 1,
          "success": true
        }
      ],
      "detection": {
        "id": "text",
        "type": "RULE"
      },
      "eventCount": 1,
      "firstEventOccurredAt": "text",
      "id": "text",
      "lastReceivedEventAt": "text",
      "runbook": "text",
      "severity": "CRITICAL",
      "status": "OPEN",
      "systemError": {
        "detection": {
          "id": "text",
          "type": "RULE"
        },
        "sourceId": "text",
        "sourceType": "text",
        "type": "text"
      },
      "title": "text",
      "type": "text",
      "updatedBy": {
        "id": "user",
        "type": "text"
      }
    }
  ]
}

OK response.

Update the status or assignee of multiple alerts

patch

Authorizations

Body

assigneestringoptional

The ID of the assignee for this alert

idsstring[]required

The IDs of the alerts to patch

statusstring · enumoptional

The status of this Alert

Options: OPEN, CLOSED, TRIAGED, RESOLVED

Responses

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request PATCH \
  --url 'https://your-api-host/alerts' \
  --header 'X-API-Key: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "assignee": "text",
    "ids": [
      "text"
    ],
    "status": "OPEN"
  }'

204

400

404

204

No body

No Content response.