list_alerts
Retrieve InsightIDR alerts filtered by severity, type, status, date range, or linked investigation. Supports sorting and pagination.
Instructions
List InsightIDR alerts with optional filters for severity, type, status, and date range
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Number of results to return (1-100) | |
| sort | No | Sort field (e.g., '-created_time' for newest first) | |
| type | No | Filter by alert type/source | |
| index | No | Pagination index | |
| status | No | Filter by alert status | |
| end_time | No | Filter alerts created before this ISO 8601 timestamp | |
| severity | No | Filter by alert severity | |
| start_time | No | Filter alerts created after this ISO 8601 timestamp | |
| investigation_id | No | Filter alerts linked to a specific investigation |