Other endpoints
List alert rules for a specified organization and their current status (enabled or disabled)
path Parameters
regionThe region you want to target
query Parameters
organization_idID of the Organization to target.
status(Optional) Status of the alert rule.
pagepage_sizeList alert rules for a specified organization and their current status (enabled or disabled) › Responses
Single page of preconfigured alert rules matching the requested criteria.
total_countTotal count of alert rules matching the requested criteria.
Set the alert rules to enabled
Set the alert rules to enabled by replacing the set of enabled alert rules for a specified organization. The provided list defines the complete set of rules that should be enabled. Any previously enabled rule not included in the request will be disabled.
path Parameters
regionThe region you want to target
Set the alert rules to enabled › Request Body
organization_idID of the Organization to target.
enabled_alert_rule_idsList of IDs of the rules that must be enabled after the update. (UUID format)
Set the alert rules to enabled › Responses
List of the preconfigured rules that were enabled.
path Parameters
regionThe region you want to target
query Parameters
organization_idproject_idresource_typerecorded_after(RFC 3339 format)
recorded_before(RFC 3339 format)
order_bypage_sizepage_tokenResponses
next_page_tokenRetrieve available fields for custom alert rules
Retrieve all available fields that can be used to construct Common Expression Language (CEL) queries for custom alert rules.
path Parameters
regionThe region you want to target
query Parameters
organization_idRegion to target. If none is passed will use default region from the config.
Retrieve available fields for custom alert rules › Responses
A list of fields that are authorized to be used in a CEL expression.
total_countNumber of fields.
List custom alert rules for a specified organization and their current status (enabled or disabled)
path Parameters
regionThe region you want to target
query Parameters
organization_idID of the Organization to target.
status(Optional) Status of the custom alert rule.
pagepage_sizeList custom alert rules for a specified organization and their current status (enabled or disabled) › Responses
Single page of custom alert rules matching the requested criteria.
total_countTotal count of custom alert rules matching the requested criteria.
Set the custom alert rules to enabled
Set the custom alert rules to enabled by replacing the set of enabled custom alert rules for a specified organization. The provided list defines the complete set of custom rules that should be enabled. Any previously enabled custom rule not included in the request will be disabled.
path Parameters
regionThe region you want to target
Set the custom alert rules to enabled › Request Body
organization_idID of the Organization to target.
enabled_custom_alert_rule_idsList of IDs of the custom rules that must be enabled after the update. (UUID format)
Set the custom alert rules to enabled › Responses
List of the custom rules that were enabled.
Create a custom alert rule
Create a custom alert rule in a given region specified by the region parameter.
path Parameters
regionThe region you want to target
Create a custom alert rule › Request Body
organization_idID of the Organization to target.
name^[a-zA-Z0-9]([-_.a-z…Name of the custom alert rule.
description(Optional) Description of the custom alert rule.
queryThe Common Expression Language (CEL) string defining the logic for the alert rule.
evaluation_windowThe duration of time over which to evaluate the rule (how far back to look for matching events). (in seconds)
occurrencesThe minimum number of matched occurrences required within the evaluation window to trigger the alert.
severity(Optional) The severity level assigned to the custom alert rule. By default, the severity will be set to info.
Create a custom alert rule › Responses
idID of the alert rule. (UUID format)
srn^srn://audit-trail\.…The SRN of the alert rule.
nameName of the alert rule.
description(Optional) Description of the alert rule.
statusCurrent status of the alert rule.
queryThe Common Expression Language (CEL) string defining the logic for the alert rule.
evaluation_windowThe duration of time over which to evaluate the rule (how far back to look for matching events). (in seconds)
occurrencesThe minimum number of matched occurrences required within the evaluation window to trigger the alert.
severityThe severity level assigned to the custom alert rule.
created_atCustom alert rule creation date. (RFC 3339 format)
updated_atCustom alert rule last modification date. (RFC 3339 format)
regionRegion of the alert rule.
Get custom alert rule metadata
Retrieve metadata for a specified custom alert rule using the region and custom_alert_rule_id parameters.
path Parameters
regionThe region you want to target
custom_alert_rule_idID of the custom alert rule to retrieve.
Get custom alert rule metadata › Responses
idID of the alert rule. (UUID format)
srn^srn://audit-trail\.…The SRN of the alert rule.
nameName of the alert rule.
description(Optional) Description of the alert rule.
statusCurrent status of the alert rule.
queryThe Common Expression Language (CEL) string defining the logic for the alert rule.
evaluation_windowThe duration of time over which to evaluate the rule (how far back to look for matching events). (in seconds)
occurrencesThe minimum number of matched occurrences required within the evaluation window to trigger the alert.
severityThe severity level assigned to the custom alert rule.
created_atCustom alert rule creation date. (RFC 3339 format)
updated_atCustom alert rule last modification date. (RFC 3339 format)
regionRegion of the alert rule.
Update a custom alert rule
Modify a custom alert rule's metadata including name and description, specified by the alert_rule_id and region parameters.
path Parameters
regionThe region you want to target
custom_alert_rule_idID of the custom alert rule to update.
Update a custom alert rule › Request Body
name^[a-zA-Z0-9]([-_.a-z…(Optional) New name for the custom alert rule.
description(Optional) New description for the custom alert rule.
Update a custom alert rule › Responses
idID of the alert rule. (UUID format)
srn^srn://audit-trail\.…The SRN of the alert rule.
nameName of the alert rule.
description(Optional) Description of the alert rule.
statusCurrent status of the alert rule.
queryThe Common Expression Language (CEL) string defining the logic for the alert rule.
evaluation_windowThe duration of time over which to evaluate the rule (how far back to look for matching events). (in seconds)
occurrencesThe minimum number of matched occurrences required within the evaluation window to trigger the alert.
severityThe severity level assigned to the custom alert rule.
created_atCustom alert rule creation date. (RFC 3339 format)
updated_atCustom alert rule last modification date. (RFC 3339 format)
regionRegion of the alert rule.
Delete a custom alert rule
Permanently delete a custom alert rule specified by the region and alert_rule_id parameters. This action is irreversible.
path Parameters
regionThe region you want to target
custom_alert_rule_idID of the custom alert rule to delete.
Delete a custom alert rule › Responses
Disable alert rules
Disable alert rules for a specified organization. Disabled rules will no longer trigger alerts when matching events occur.
path Parameters
regionThe region you want to target
Disable alert rules › Request Body
organization_idID of the Organization to target.
alert_rule_idsList of IDs of the rules to disable. (UUID format)
Disable alert rules › Responses
List of the preconfigured rules that were disabled.
Disable custom alert rules
Disable custom alert rules for a specified organization. Disabled rules will no longer trigger alerts when matching events occur.
path Parameters
regionThe region you want to target
Disable custom alert rules › Request Body
organization_idID of the Organization to target.
custom_alert_rule_idsList of IDs of the custom rules to disable. (UUID format)
Disable custom alert rules › Responses
List of the custom rules that were disabled.
Enable alert rules
Enable alert rules for a specified organization. Enabled rules will trigger alerts when matching events occur.
path Parameters
regionThe region you want to target
Enable alert rules › Request Body
organization_idID of the Organization to target.
alert_rule_idsList of IDs of the rules to enable. (UUID format)
Enable alert rules › Responses
List of the preconfigured rules that were enabled.
Enable custom alert rules
Enable custom alert rules for a specified organization. Enabled custom rules will trigger alerts when matching events occur.
path Parameters
regionThe region you want to target
Enable custom alert rules › Request Body
organization_idID of the Organization to target.
custom_alert_rule_idsList of IDs of the custom rules to enable. (UUID format)
Enable custom alert rules › Responses
List of the custom rules that were enabled.
path Parameters
regionThe region you want to target
query Parameters
organization_idFilter by Organization ID.
name(Optional) Filter by export name.
tags(Optional) List of tags to filter on.
pagepage_sizeorder_byResponses
Single page of export jobs matching the requested criteria.
total_countTotal count of export jobs matching the requested criteria.
Test a custom alert rule
Test whether a custom alert rule's condition is currently satisfied, without needing to create or enable it.
path Parameters
regionThe region you want to target
Test a custom alert rule › Request Body
organization_idID of the Organization to target.
queryThe Common Expression Language (CEL) string defining the logic for the alert rule.
evaluation_windowThe duration of time over which to evaluate the rule (how far back to look for matching events). (in seconds)
occurrencesThe minimum number of matched occurrences required within the evaluation window to trigger the alert.
Test a custom alert rule › Responses
firingTrue when the alert rule's condition is currently satisfied, false otherwise. A false return value does not mean the alert rule is incorrect, only that it is not currently firing.