teramind_list_alerts
Retrieve fired rule-violation alerts within a specified time window, filtered by agent, computer, or department, to identify the triggering rule, timestamp, and affected machine.
Instructions
List alerts (fired rule-violation events) in a time window - which rule fired, when, for which agent/computer, and the rule's own description/caption fields. periodStart and periodEnd are required (ISO 8601 datetime, e.g. 2026-01-01T00:00:00Z); optionally scope to specific agents/computers/departments (comma-separated IDs). NOTE: depending on the rule type that fired, a rule's description/caption/values fields MAY include a short excerpt of the triggering context (e.g. a matched keyword or URL) rather than pure metadata - this is Teramind's documented alert response shape, passed through as received.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results. Defaults to 50. | |
| agents | No | Comma-separated agent IDs to filter by. From teramind_list_agents. | |
| offset | No | Pagination offset. Defaults to 0. | |
| computers | No | Comma-separated computer IDs to filter by. From teramind_list_computers. | |
| periodEnd | Yes | ISO datetime, inclusive upper bound. | |
| departments | No | Comma-separated department IDs to filter by. From teramind_list_departments. | |
| periodStart | Yes | ISO datetime, inclusive lower bound. |