List fired alerts (history) from the System Event Index
sumo_list_alertsRetrieve fired alerts from Sumo Logic and correlate create and resolve events into one entry per alert. Filter by time range, status, or monitor name.
Instructions
Fired-alert HISTORY — the complement to sumo_list_monitors (definitions + current state): queries the documented System Event Index (_index=sumologic_system_events _sourceCategory=alerts) through the standard Search Job API. The index is enabled and searchable by default on Enterprise accounts (the same tier the Search Job API already requires). Alert create and resolve are SEPARATE events — this tool correlates them into one line per fired alert: fired-at, resolved-at (when the resolve event is in range), latest trigger status, and the monitorId + monitor name JOIN KEYS back to sumo_list_monitors. One search job, auto-deleted. Time range: exactly ONE of last (relative, e.g. "15m", "2h"; units s/m/h/d) OR both from and to (ISO-8601 like 2026-07-02T18:28:00, or epoch milliseconds).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time: ISO-8601 or epoch ms. Requires `from`. | |
| from | No | Start time: ISO-8601 or epoch ms. Requires `to`. | |
| last | No | Relative window ending now, e.g. "15m", "2h", "1d". Mutually exclusive with from/to. | |
| limit | No | Max fired alerts returned (default 50). | |
| status | No | Client-side filter on trigger state (e.g. ["Critical","Warning"]; case-insensitive). By default matches the alert's LATEST state — a resolved Critical alert now shows [Normal] and is EXCLUDED. Use statusScope:"ever" for the old lifetime behavior. | |
| timeZone | No | IANA timezone for query-time parsing (default UTC). | |
| statusScope | No | How `status` matches (default "latest"): "latest" = the alert's current/most-recent state; "ever" = any state seen across its lifetime events. | |
| monitorQuery | No | Keyword filter (e.g. a monitor-name fragment), matched full-text against the alert event JSON. | |
| byReceiptTime | No | Search by receipt time; recommended true for very recent windows (ingestion lag). |