---
title: "Get Alerts"
method: GET
path: "/v2/alerts/{client_id}/"
tags: ["v2 alerts"]
---

# Get Alerts

`GET /v2/alerts/{client_id}/`

## Path parameters

- `client_id` string, uuid, required

## Query parameters

- `category` 'reportable' | 'benign' | 'investigated' | 'resolved' | 'escalated' | 'noncritical' | 'critical'
- `size` integer
- `sort` string, nullable
- `stream` boolean
- `next_page_token` string, nullable

## Response `200`

Successful Response

- AlertResponse
  - `total` integer, required
  - `page` CurrentPageInfo, required
    - `size` integer, required
    - `number` integer, required
  - `next` NextPageInfo, required
    - `url` string, nullable, required
    - `expires_at` integer, nullable, required
  - `category` 'reportable' | 'benign' | 'investigated' | 'resolved' | 'escalated' | 'noncritical' | 'critical', required
  - `filter` HitFilter, required
    - `terms` object[], required
    - `ranges` object[], required
  - `sort` object[], required
  - `alerts` union[], required
    - union
      - SaganAlert
        - `alert` AlertInfo, required
          - `action` string, required
          - `category` string, required
          - `gid` integer, required
          - `metadata` object, required
          - `rev` string, required
          - `rule` string, required
          - `severity` integer, required
          - `signature` string, required
          - `signature_id` string, required
        - `analyst` AnalystResponse[], required
          - `critical` string, required
          - `long_description` string, required
          - `name` string, required
          - `priority` integer, required
          - `short_description` string, required
          - `short_description_id` integer, required
          - `timestamp` string, date-time, required
        - `analyst_final_response` AnalystResponse, required
          - `critical` string, required
          - `long_description` string, required
          - `name` string, required
          - `priority` integer, required
          - `short_description` string, required
          - `short_description_id` integer, required
          - `timestamp` string, date-time, required
        - `auto_answer` string, required
        - `auto_answer_id` string, required
        - `auto_emailed` string, required
        - `bluedot` BluedotInfo, required
          - `src` BluedotSrc, required
            - `api_user` string, required
            - `category` string, required
            - `code` integer, required
            - `comments` string, required
            - `counter` integer, required
            - `ctime` string, date-time, required
            - `ctime_epoch` integer, required
            - `last_seen` string, date-time, required
            - `mtime` string, date-time, required
            - `mtime_epoch` integer, required
            - `query` string, required
            - `query_counter` integer, required
            - `query_timestamp` string, date-time, required
            - `query_type` string, required
            - `source` string, required
        - `critical` string, required
        - `cust_id` string, required
        - `dest_dns` string, required
        - `dest_ip` string, required
        - `dest_port` string, required
        - `emailed` string, required
        - `es_index` string, required
        - `event_type` string, required
        - `flow_id` string, required
        - `geoip` GeoIPInfo, required
          - `dest` GeoIPLocation, required
            - `city` string, required
            - `country` string, required
            - `latitude` number, required
            - `longitude` number, required
            - `postal` string, required
            - `subdivision` string, required
            - `timezone` string, required
          - `src` GeoIPLocation, required
            - `city` string, required
            - `country` string, required
            - `latitude` number, required
            - `longitude` number, required
            - `postal` string, required
            - `subdivision` string, required
            - `timezone` string, required
        - `geoip_dest` GeoIPLocation, required
          - `city` string, required
          - `country` string, required
          - `latitude` number, required
          - `longitude` number, required
          - `postal` string, required
          - `subdivision` string, required
          - `timezone` string, required
        - `geoip_src` GeoIPLocation, required
          - `city` string, required
          - `country` string, required
          - `latitude` number, required
          - `longitude` number, required
          - `postal` string, required
          - `subdivision` string, required
          - `timezone` string, required
        - `host` string, required
        - `in_iface` string, required
        - `proto` string, required
        - `sensor_description` string, required
        - `snort_cid` string, required
        - `snort_id` string, required
        - `snort_sid` string, required
        - `src_dns` string, required
        - `src_ip` string, required
        - `src_port` string, required
        - `timestamp` string, date-time, required
        - `facility` string, required
        - `level` string, required
        - `normalize` NormalizationInfo, required
          - `src-ip` string, required
          - `src-port` string, required
          - `username` string, required
        - `payload` string, required
        - `priority` string, required
        - `program` string, required
        - `sensor_type` string
        - `stream` string, required
        - `tag` string, required
        - `xff` string, required
      - SuricataAlert
        - `alert` AlertInfo, required
          - `action` string, required
          - `category` string, required
          - `gid` integer, required
          - `metadata` object, required
          - `rev` string, required
          - `rule` string, required
          - `severity` integer, required
          - `signature` string, required
          - `signature_id` string, required
        - `analyst` AnalystResponse[], required
          - `critical` string, required
          - `long_description` string, required
          - `name` string, required
          - `priority` integer, required
          - `short_description` string, required
          - `short_description_id` integer, required
          - `timestamp` string, date-time, required
        - `analyst_final_response` AnalystResponse, required
          - `critical` string, required
          - `long_description` string, required
          - `name` string, required
          - `priority` integer, required
          - `short_description` string, required
          - `short_description_id` integer, required
          - `timestamp` string, date-time, required
        - `auto_answer` string, required
        - `auto_answer_id` string, required
        - `auto_emailed` string, required
        - `bluedot` BluedotInfo, required
          - `src` BluedotSrc, required
            - `api_user` string, required
            - `category` string, required
            - `code` integer, required
            - `comments` string, required
            - `counter` integer, required
            - `ctime` string, date-time, required
            - `ctime_epoch` integer, required
            - `last_seen` string, date-time, required
            - `mtime` string, date-time, required
            - `mtime_epoch` integer, required
            - `query` string, required
            - `query_counter` integer, required
            - `query_timestamp` string, date-time, required
            - `query_type` string, required
            - `source` string, required
        - `critical` string, required
        - `cust_id` string, required
        - `dest_dns` string, required
        - `dest_ip` string, required
        - `dest_port` string, required
        - `emailed` string, required
        - `es_index` string, required
        - `event_type` string, required
        - `flow_id` string, required
        - `geoip` GeoIPInfo, required
          - `dest` GeoIPLocation, required
            - `city` string, required
            - `country` string, required
            - `latitude` number, required
            - `longitude` number, required
            - `postal` string, required
            - `subdivision` string, required
            - `timezone` string, required
          - `src` GeoIPLocation, required
            - `city` string, required
            - `country` string, required
            - `latitude` number, required
            - `longitude` number, required
            - `postal` string, required
            - `subdivision` string, required
            - `timezone` string, required
        - `geoip_dest` GeoIPLocation, required
          - `city` string, required
          - `country` string, required
          - `latitude` number, required
          - `longitude` number, required
          - `postal` string, required
          - `subdivision` string, required
          - `timezone` string, required
        - `geoip_src` GeoIPLocation, required
          - `city` string, required
          - `country` string, required
          - `latitude` number, required
          - `longitude` number, required
          - `postal` string, required
          - `subdivision` string, required
          - `timezone` string, required
        - `host` string, required
        - `in_iface` string, required
        - `proto` string, required
        - `sensor_description` string, required
        - `snort_cid` string, required
        - `snort_id` string, required
        - `snort_sid` string, required
        - `src_dns` string, required
        - `src_ip` string, required
        - `src_port` string, required
        - `timestamp` string, date-time, required
        - `flow` FlowStats, required
          - `bytes_toclient` string, required
          - `bytes_toserver` string, required
          - `pkts_toclient` string, required
          - `pkts_toserver` string, required
          - `start` string, date-time, required
        - `packet` string, required
        - `packet_info` PacketInfo, required
          - `linktype` integer, required
        - `sensor_type` string
        - `stream` integer, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/qis/apis/quadrant-api.md) · [All operations](https://skmtc.dev/qis/apis/quadrant-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/qis/quadrant-api/revisions/0f7487193424/schema)