List alerting monitors
malcolm_alerting_monitorsRead-only
List OpenSearch alerting monitors and their targets, with active alert counts, to verify standing detections are enabled and working.
Instructions
List OpenSearch alerting monitors, what each watches, and whether any have fired.
Use this to find the standing detections someone already configured, and
to check they are actually running — a disabled monitor is silent in
exactly the way a healthy one is. It stops at what each monitor is and
whether it is enabled: the query and trigger condition behind one need
malcolm_alerting_monitor_detail, and what has actually fired needs
malcolm_alerting_alerts. These are OpenSearch alerting rules, which are
a different thing from Suricata's IDS alerts: for those use
malcolm_alerts. To record a new finding rather than read a rule, use
malcolm_create_alert (needs the alerting write class).
Returns JSON {"total", "showing", "active_alerts", "monitors"};
per-monitor fields are in the output schema. `active_alerts` counts only
alerts in the ACTIVE state, not the COMPLETED history the API returns by
default. When every monitor is disabled the response says so, and
whether that covers all of them or only the page returned.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max monitors to return. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |