Skip to main content
GET
/
alarms
Get a page of alarms
curl --request GET \
  --url https://your-subdomain.alienvault.cloud/api/2.0/alarms \
  --header 'Authorization: Bearer <token>'
{
  "_links": {
    "first": {
      "href": "https://mysubdomain.alienvault.cloud/api/2.0/alarms?page=0&size=20&sort=timestamp_occured,desc"
    },
    "self": {
      "href": "https://mysubdomain.alienvault.cloud/api/2.0/alarms"
    },
    "next": {
      "href": "https://mysubdomain.alienvault.cloud/api/2.0/alarms?page=1&size=20&sort=timestamp_occured,desc"
    },
    "last": {
      "href": "https://mysubdomain.alienvault.cloud/api/2.0/alarms?page=175&size=20&sort=timestamp_occured,desc"
    }
  },
  "_embedded": {
    "alarms": [
      {
        "uuid": "971918fd-a569-548a-5a80-1ffcda2a8365",
        "priority": 20,
        "status": "open",
        "rule_intent": "Environmental Awareness"
      }
    ]
  },
  "page": {
    "size": 20,
    "totalElements": 3506,
    "totalPages": 176,
    "number": 0
  }
}

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

​
page
integer

The page number of results to return (zero-based).

​
size
integer

The number of results to return per page.

​
sort
string

The parameter and direction to sort results by.

Example:

"timestamp_occured,asc"

​
status
enum<string>[]

Filter by the status of the alarm.

Available options:
open,
closed,
in_review
​
suppressed
boolean

Filter alarms by the suppressed flag.

​
rule_intent
string

Filter by the intent of the rule that triggered the alarm.

​
rule_method
string

Filter by the method of the rule that triggered the alarm.

​
rule_strategy
string

Filter by the strategy of the rule that triggered the alarm.

​
priority_label
enum<string>[]

Filter by the priority of the alarm.

Available options:
low,
medium,
high
​
alarm_sensor_sources
string<uuid>

Filter by the UUID of the sensor.

​
timestamp_occured_gte
integer<int64>

Filter for alarms that occurred at or after this timestamp (epoch milliseconds).

​
timestamp_occured_lte
integer<int64>

Filter for alarms that occurred at or before this timestamp (epoch milliseconds).

Response

200 - application/json

A paginated list of alarms.

​
_links
object
required
​
_embedded
object
required
​
page
object
required