zdx_list_historical_alerts
Retrieve a list of ended ZDX alerts, filterable by time range, location, department, or geo ID. Supports up to 14 days of history.
Instructions
List historical (ended) ZDX alerts.
Read-only. Like zdx_list_alerts but for alert rules that have an Ended On
date. since is in HOURS (default 2h, max 14 days = 336h).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No | Optional JMESPath expression applied to the results after the API call, for client-side filtering and projection. Field names are exactly what the Zscaler API returns. Examples: "[?enabled==`true`]", "[*].{name: name, id: id}", "length(@)". Omit to get the full records. | |
| since | No | ||
| geo_id | No | ||
| offset | No | ||
| location_id | No | ||
| department_id | No |