saas_alerts_events_query
Retrieve paginated security events from SaaS Alerts using filters for date range, severity, user, and more.
Instructions
Query security events from SaaS Alerts with optional filters. Returns a paginated list of events matching the specified criteria.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | Offset for pagination | |
| size | No | Maximum results to return (default 50) | |
| end_date | No | End of range — ISO-8601 timestamp or epoch ms (inclusive) | |
| time_sort | No | Sort direction on event timestamp | |
| event_type | No | Filter by one or more event types | |
| start_date | No | Start of range — ISO-8601 timestamp or epoch ms (inclusive) | |
| user_email | No | Filter by user email (UPN) | |
| customer_id | No | Filter by SaaS Alerts customer ID | |
| alert_status | No | Filter by alert severity |