get_alert_notes
Get all notes and comments attached to an alert to view investigation context, analyst findings, and collaboration history.
Instructions
Get all notes and comments associated with an alert.
Retrieves all analyst notes, comments, and annotations attached to a specific alert. Notes provide context, analysis findings, investigation steps, and collaboration history.
Args: alert_id: The unique identifier of the alert.
Returns: List of notes in JSON format, each containing: - id: Unique note identifier - text: Note content/message - createdAt: ISO timestamp when note was created - author: User information {userId, email, fullName} - alertId: Associated alert identifier
Notes are typically ordered by creation time (newest first).Common Use Cases: - Investigation documentation and collaboration - Tracking analyst findings and decisions - Audit trail for alert handling - Knowledge sharing between team members - Compliance and reporting requirements
Note: Returns empty array if no notes exist. Check alert.noteExists field from get_alert to avoid unnecessary calls.
Raises: RuntimeError: If there's an error retrieving alert notes. ValueError: If alert_id is invalid or empty.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alert_id | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |