List alerts raised by alerting monitors
malcolm_alerting_alertsRead-only
Get fired OpenSearch alerting alerts in any lifecycle state, with filters for search text, severity, and monitor id. Use to see what happened overnight rather than what monitors are watching.
Instructions
Read what OpenSearch alerting monitors have actually fired, in any state.
Use this for "what fired overnight". malcolm_alerting_monitors lists the
standing rules and counts only ACTIVE alerts, so a monitor that fired and
then recovered — state COMPLETED — is invisible there, as are the
per-monitor, per-severity and free-text filters. That tool answers "what
is being watched", this one answers "what happened". These are OpenSearch
alerting alerts, a different mechanism from Suricata's IDS alerts: for
those use malcolm_alerts. To read the rule behind an alert, take its
monitor id to malcolm_alerting_monitor_detail.
alert_state and severity are validated here rather than passed through:
measured on Malcolm v26.07.1, an unknown alertState or severityLevel answers
200 with an empty list rather than 400, so a typo would look exactly like
a quiet night.
Returns JSON {"total", "showing", "alerts"} with each alert as the
plugin sends it — monitor id and name, trigger name, state, severity and
the start/end/acknowledged timestamps. An empty list is a successful
answer and a common one, since no alert can exist while every monitor is
disabled.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| search | No | Free-text match across the alert fields (monitor name, trigger name). Empty = no text filter. | |
| severity | No | Keep only alerts whose trigger is configured at this severity, "1" (highest) through "5". This is the level a human set on the trigger, not a score computed from the traffic. Empty = any. | |
| monitor_id | No | Keep only one monitor's alerts, using the `id` malcolm_alerting_monitors returns (not the monitor name). Empty = every monitor. | |
| alert_state | No | Lifecycle state to return: ALL (default), ACTIVE (firing now), ACKNOWLEDGED (an analyst has seen it, still firing), COMPLETED (fired and has since recovered — the overnight history), ERROR (the monitor itself failed to run), DELETED (the alert outlived the monitor that raised it — a state to read, nothing here removes anything). Case-insensitive. | ALL |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |