list_alerts
List alerts with pagination and filtering by assignment status to manage alert queues, dashboard feeds, or bulk processing workflows.
Instructions
List alerts with pagination and filtering capabilities.
Retrieves a paginated list of alerts with basic filtering by assignment status. For advanced filtering by severity, status, time ranges, etc., use search_alerts instead.
Args: first: Number of alerts to retrieve (1-100, default: 10). after: Pagination cursor from previous response (optional). Use pageInfo.endCursor from previous response to get next page. view_type: Assignment filter with options: - "ALL": Show all alerts (default) - "ASSIGNED_TO_ME": Only alerts assigned to current user - "UNASSIGNED": Only unassigned alerts - "MY_TEAM": Only alerts assigned to user's team fields: Optional JSON string containing an array of field names to return. If not specified, returns all default fields (including dataSources). Use minimal fields like '["id"]' when paging through intermediate results.
Available fields:
- Basic: "id", "externalId", "severity", "status", "name", "description"
- Timing: "detectedAt", "firstSeenAt", "lastSeenAt"
- Analysis: "analystVerdict", "classification", "confidenceLevel"
- Context: "noteExists", "result", "storylineId", "ticketId", "dataSources"
- Nested objects (returns all subfields):
- "detectionSource" (product, vendor)
- "asset" (id, name, type)
- "assignee" (userId, email, fullName)
IMPORTANT - dataSources field behavior:
- When fields=None (default): dataSources is INCLUDED automatically
- When fields is provided: dataSources is ONLY included if explicitly requested
Example with dataSources: '["id", "severity", "dataSources"]'
Example without: '["id", "severity"]' (dataSources will be omitted)
Examples:
- Minimal for paging: '["id"]'
- Summary view: '["id", "severity", "status", "name", "detectedAt"]'
- With dataSources: '["id", "severity", "dataSources"]'
- Full details: omit fields parameter or pass NoneReturns: Paginated alert list in JSON format containing: - edges: Array of alert objects (with requested fields only) - pageInfo: Pagination metadata - hasNextPage: Boolean indicating more results available - hasPreviousPage: Boolean indicating previous page exists - startCursor: Cursor for first item in current page - endCursor: Cursor for last item (use for next page) - totalCount: Total number of matching alerts (if available)
Common Use Cases: - Dashboard alert feeds and overviews - Assignment-based alert distribution - Bulk alert processing workflows - Alert queue management
Pagination Example: 1. Call with first=20 to get first 20 alerts 2. Use pageInfo.endCursor as 'after' parameter for next 20 3. Continue until pageInfo.hasNextPage is false
IMPORTANT Performance Notes: - Cursor pagination is SEQUENTIAL ONLY - you cannot skip to arbitrary positions (e.g., cannot jump directly to "the 1532nd alert") - When paging through many results to reach a specific position, use fields=["id"] for intermediate pages to conserve context window - Use the totalCount field to understand the full result set size
Raises: RuntimeError: If there's an error listing alerts. ValueError: If parameters are invalid.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| first | No | ||
| after | No | ||
| view_type | No | ALL | |
| fields | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |