get_alert
Retrieve a specific alert's full details, including severity, status, assets, and analyst findings, using its ID.
Instructions
Get detailed information about a specific alert by ID.
Retrieves comprehensive alert data including metadata, timing information, severity, status, associated assets, and analyst findings.
Args: alert_id: The unique identifier of the alert (string).
Returns: Detailed alert information in JSON format containing: - id: Unique alert identifier - externalId: External system identifier (if any) - severity: CRITICAL, HIGH, MEDIUM, LOW, INFO, UNKNOWN - status: NEW, IN_PROGRESS, RESOLVED, FALSE_POSITIVE - name: Alert title/name - description: Detailed description of the alert - detectedAt: ISO timestamp when alert was first detected - firstSeenAt: ISO timestamp of first occurrence (if different) - lastSeenAt: ISO timestamp of most recent occurrence - analystVerdict: Expert analysis result (if available) - classification: Alert category/type - confidenceLevel: Detection confidence score - dataSources: List of data sources that contributed to detection - detectionSource: {product, vendor} information - asset: Associated asset information {id, name, type} - assignee: Assigned user information {userId, email, fullName} - noteExists: Boolean indicating if notes are attached - result: Investigation outcome - storylineId: Associated storyline identifier - ticketId: Associated ticket identifier
Common Use Cases: - Incident investigation and triage - Alert enrichment with contextual data - Status and assignment tracking - Evidence collection for security workflows
Raises: RuntimeError: If there's an error retrieving the alert. ValueError: If alert_id is invalid or empty.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alert_id | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |