Filter: Suppressed

Select True to show only those alarms that have suppressed flag set.

Optional

Filter: Rule Intent

Enter jinja-templated intent of the rule that triggered the alarm. Eg: Environmental Awareness or {{rule_intent_column}}.

Optional

Filter: Rule Method

Enter jinja-templated method of the rule that triggered the alarm. Eg: AWS EC2 Security Group Modified or {{rule_method_column}}.

Optional

Filter: Rule Strategy

Enter jinja-templated strategy of the rule that triggered the alarm. Eg: Network Access Control Modification or {{rule_strategy_column}}.

Optional

Filter: Sensor

Select column that contains uuid of the sensor to filter results for.

Optional

Filter: Start Time

Enter timestamp (in epoch millis) to only include alarms that occurred after this timestamp. Enter flow-start-time to use start-time of the time-range of the flow. Leaving it empty will not apply the filter.

Optional

Filter: End Time

Enter timestamp (in epoch millis) to only include alarms that occurred before this timestamp. Enter flow-end-time to use end-time of the time-range of the flow. Leaving it empty will not apply the filter.

Optional

Maximum Number Of Results To Return

The maximum number of results to return per call (Default is 100,000).

Optional

Filter: Suppressed

Select True to show only those alarms that have suppressed flag set.

Optional

Filter: Rule Intent

Enter jinja-templated intent of the rule that triggered the alarm. Eg: Environmental Awareness or {{rule_intent_column}}.

Optional

Filter: Rule Method

Enter jinja-templated method of the rule that triggered the alarm. Eg: AWS EC2 Security Group Modified or {{rule_method_column}}.

Optional

Filter: Rule Strategy

Enter jinja-templated strategy of the rule that triggered the alarm. Eg: Network Access Control Modification or {{rule_strategy_column}}.

Optional

Filter: Sensor

Select column that contains uuid of the sensor to filter results for.

Optional

Filter: Start Time

Jinja-templated timestamp (in epoch millis) to only include alarms that occurred after this timestamp. Example {{start_time}} (Default value will be flow start time)

Optional

Filter: End Time

Jinja-templated timestamp (in epoch millis) to only include alarms that occurred before this timestamp. Example {{end_time}} (Default value will be flow end time)

Optional

Maximum Number Of Results To Return

The maximum number of results to return per call (Default is 100,000).

Optional

Alarm ID

Select column that contains a value for an alarm id to fetch details.

Required

Alarm ID

Select column that contains a value for an alarm id to fetch associated events.

Required

Filter: Account Name

Enter jinja-templated name of the account to filter on.

Example: account or {{account_column}}.

Optional

Filter: Suppressed

Select True to show only those alarms that have suppressed flag set.

Optional

Filter: Plugin

Enter jinja-templated name of the plugin to filter events on.

Example: plugin or {{plugin_column}}.

Optional

Filter: Event Name

Enter jinja-templated name of the event to filter events on.

Example: name or {{name_column}}.

Optional

Filter: Source Name

Enter jinja-templated name of the source to filter events on.

Example: name or {{name_column}}.

Optional

Filter: Source Username

Enter jinja-templated name of the user that triggered the event to filter events on.

Example: user@email.com or {{userid_column}}@email.com.

Optional

Filter: Sensor

Select column that contains uuid of the sensor to filter results for.

Optional

Filter: Start Time

Enter timestamp (in epoch millis) to only include alarms that occurred after this timestamp. Enter flow-start-time to use start-time of the time-range of the flow. Leaving it empty will not apply the filter.

Optional

Filter: End Time

Enter timestamp (in epoch millis) to only include alarms that occurred before this timestamp. Enter flow-end-time to use end-time of the time-range of the flow. Leaving it empty will not apply the filter.

Optional

Page

Enter page number (0 based) of results to return.

Optional

Size

Enter number of results to return on each page.

Optional

Alarm ID

Jinja-templated text containing the id of the alarm. Example: {{alarm_id_column}}.

Required

Label ID

Jinja-templated text containing the id of the label. Example: {{label_id_column}}

Required