--- title: "List child alerts for a given aggregated alert bucket" method: GET path: "/alerts/{id}/aggregates" tags: ["DTM Alerts"] --- # List child alerts for a given aggregated alert bucket `GET /alerts/{id}/aggregates` ## Request - Base URL: `https://www.virustotal.com/api/v3/dtm` - URL: `https://www.virustotal.com/api/v3/dtm/alerts/{id}/aggregates` - Auth: none required ## Path parameters - `id` string, required ## Query parameters - `sort` 'id' | 'created_at' | 'updated_at' | 'monitor_id' - `order` 'asc' | 'desc' - `size` integer - `monitor_id` string - `refs` boolean - `replace_links` boolean - `monitor_name` boolean - `has_analysis` boolean - `buckets` boolean - `since` string, date-time - `until` string, date-time - `page` string - `truncate` integer - `status` 'new' | 'read' | 'escalated' | 'in_progress' | 'closed' | 'no_action_required' | 'duplicate' | 'not_relevant' | 'tracked_external' - `alert_type` 'Compromised Credentials' | 'Domain Discovery' | 'Forum Post' | 'Message' | 'Paste' | 'Shop Listing' | 'Tweet' | 'Web Content' - `search` string - `match_value` string - `tags` string - `search_encoding` 'base64' - `severity` 'high' | 'medium' | 'low' - `sanitize` string - `mscore_gte` integer ## Headers - `x-apikey` string, required ## Response `200` OK - Alerts: A list of alerts. - `alerts` Alert[], required - `aggregated_added_at` string, date-time: Only applicable to alert buckets, this field is the timestamp at which the most recent child alert was aggregated into the bucket. - `aggregated_alert_count` integer: Only applicable to alert buckets, and indicates the number of alerts aggregated into this bucket alert. - `aggregated_alert_count_new` integer: Only applicable to alert buckets, and indicates the number of alerts with new status in this bucket alert. - `aggregated_alerts` AggregatedAlertRef[]: Only applciable to alert buckets, this field contains metadata about each child alert aggregated into this bucket. - `created_at` string, date-time: The time the child alert was created. - `doc_type` string: The document type of the child alert. - `has_analysis` boolean: A boolean indicating if the child alert has analysis or file attachments. - `id` string: The ID of the aggregated chid alert. - `monitor_id` string: The ID of the monitor that generated the child alert. - `status` 'new' | 'read' | 'escalated' | 'in_progress' | 'closed' | 'no_action_required' | 'duplicate' | 'not_relevant' | 'tracked_external': The status of the child alert. - `tags` string[]: The tags of the child alert. - `aggregated_under_id` string: Only applicable to child alerts that are aggregated into a bucket, this field is the ID of the parent bucket alert. - `ai_doc_summary` string: If the group has the AI features enabled, this field will contain the AI analysis summary. - `alert_summary` string, required: The summary of the alert. - `alert_type` 'Compromised Credentials' | 'Domain Discovery' | 'Forum Post' | 'Message' | 'Paste' | 'Shop Listing' | 'Tweet' | 'Web Content', required: The type of this alert. - `analysis` string: If analysis has been added to the alert, then this property contains the analysis text. - `attachments` FileAttachment[]: File attachments associated with the alert as part of the alert's analysis. - `content_type` string: The content type of the file attachment. - `created_at` string, date-time: The time the file attachment was created. - `created_by_user_id` string: The user ID that created the attachment. - `filesize_bytes` integer: The size of the attachment measured in bytes. - `id` string: The ID of the file attachment. - `name` string: The file name of the attachment. - `created_at` string, required: The time this alert was created at. - `doc` union - Message - `__id` string - `__type` string - `body` string - `channel` Channel - `__id` string - `__type` string - `channel_id` string - `channel_info` ChannelInfo - `description` string - `invite_url` string - `messenger` Service - `__id` string - `__type` string - `description` string - `geo_location` GeoLocation - … - `id` string - `inet_location` InetLocation - … - `name` string - `software` string - `name` string - `edit_of` string - `in_reply_to` string - `ingested` string, date-time - `message_id` string - `messenger` Service - `__id` string - `__type` string - `description` string - `geo_location` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - … - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - … - `id` string - `inet_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `name` string - `software` string - `original_id` string - `parts` MimePart[] - `body` string - `content_type` string - `filename` string - `hashes` Hashes - `sha256` string - `sender` Profile - `__id` string - `__type` string - `contact` Contact - `__id` string - `__type` string - `aim` string - `email` string - `email_domain` string - `email_redacted` string - `fax` string - `geo_location` GeoLocation - … - `icq` string - `jid` string - `msnm` string - `phone` string - `twitter_handle` string - `website` string - `created` string, date-time - `identity` Identity - `__id` string - `__type` string - `dob` string, date-time - `dob_format` string - `first_name` string - `last_name` string - `mmn` string - `name` string - `ssn` string - `language` string - `telegram` TelegramProfile - `name` string - `user_id` integer - `twitter` TwitterProfile - `__id` string - `__type` string - `description` string - `followers_count` integer - `id_str` string - `profile_background_location` InetLocation - … - `profile_banner_location` InetLocation - … - `profile_image_location` InetLocation - … - `protected` boolean - `statuses_count` integer - `user_location` string - `verified` boolean - `source` string - `timestamp` string, date-time - Paste - `__id` string - `__type` string - `author` Profile - `__id` string - `__type` string - `contact` Contact - `__id` string - `__type` string - `aim` string - `email` string - `email_domain` string - `email_redacted` string - `fax` string - `geo_location` GeoLocation - … - `icq` string - `jid` string - `msnm` string - `phone` string - `twitter_handle` string - `website` string - `created` string, date-time - `identity` Identity - `__id` string - `__type` string - `dob` string, date-time - `dob_format` string - `first_name` string - `last_name` string - `mmn` string - `name` string - `ssn` string - `language` string - `telegram` TelegramProfile - `name` string - `user_id` integer - `twitter` TwitterProfile - `__id` string - `__type` string - `description` string - `followers_count` integer - `id_str` string - `profile_background_location` InetLocation - … - `profile_banner_location` InetLocation - … - `profile_image_location` InetLocation - … - `protected` boolean - `statuses_count` integer - `user_location` string - `verified` boolean - `body` string - `collection_ts` string, date-time - `ingested` string, date-time - `paste_id` string - `service` Service - `__id` string - `__type` string - `description` string - `geo_location` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - … - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - … - `id` string - `inet_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `name` string - `software` string - `source` string - `source_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `timestamp` string, date-time - `title` string - ShopListing - `__id` string - `__type` string - `batch` ProductBatch - `__id` string - `__type` string - `description` string - `name` string - `release_date` string, date-time - `currency` string - `data_availability` DataAvailability - `__id` string - `__type` string - `admin_access_available` boolean - `cvc_available` boolean - `dob_available` boolean - `email_available` boolean - `geo_location_available` boolean - `mmn_available` boolean - `name_available` boolean - `phone_available` boolean - `pin_available` boolean - `pvki_available` boolean - `pvv_available` boolean - `ssn_available` boolean - `track1_available` boolean - `track2_available` boolean - `vbv_available` boolean - `description` string - `host_access` HostAccess - `host_info` HostInfo - `av_installed` boolean - `cpu` Cpu - … - `files` File[] - … - `geo_location` GeoLocation - … - `hard_disks` HardDisk[] - … - `http_cookies` HttpCookie[] - … - `installed_memory` integer - `installed_software` Product[] - `network_info` NetworkInfo - … - `number_user_accounts` integer - `operating_system` string - `ransomware_installed` boolean - `service_accounts` ServiceAccount[] - … - `sites_visited` InetLocation[] - … - `tags` Tag[] - … - `uptime` integer - `virtualization` string - `service_account` ServiceAccount - `created_at` string, date-time - `login` string - `original_id` string - `password` Password - … - `profile` Profile - … - `security_questions` SecurityQuestion[] - … - `service` Service - … - `service_account_info` ServiceAccountInfo - … - `host_info` HostInfo - `av_installed` boolean - `cpu` Cpu - `cores` integer - `product` string - `files` File[] - `filename` string - `geo_location` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - … - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - … - `hard_disks` HardDisk[] - `size` integer - `http_cookies` HttpCookie[] - `domain` string - `installed_memory` integer - `installed_software` Product[] - `network_info` NetworkInfo - `ad_domain` string - `blacklisted_by` Organization[] - `domain` string - `download_bw` number, float - `host_name` string - `ipv4` string, ip - `is_proxy` boolean - `isp` string - `partial_ipv4` string, ip - `upload_bw` number, float - `number_user_accounts` integer - `operating_system` string - `ransomware_installed` boolean - `service_accounts` ServiceAccount[] - `created_at` string, date-time - `login` string - `original_id` string - `password` Password - … - `profile` Profile - … - `security_questions` SecurityQuestion[] - … - `service` Service - … - `service_account_info` ServiceAccountInfo - … - `sites_visited` InetLocation[] - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `tags` Tag[] - `location_point` string - `name` string - `value` string - `uptime` integer - `virtualization` string - `ingested` string, date-time - `is_verified` boolean - `item_qty` integer - `item_sold` integer - `item_type` string - `listing_id` string - `listing_url` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `payment_card` PaymentCard - `__id` string - `__type` string - `brand` string - `expiry_date` string, date-time - `issuer` string - `owner` Profile - `__id` string - `__type` string - `contact` Contact - … - `created` string, date-time - `identity` Identity - … - `language` string - `telegram` TelegramProfile - … - `twitter` TwitterProfile - … - `partial_number_prefix` string - `partial_number_suffix` string - `product` string - `service_code` string - `type` string - `vbv` string - `price` number, float - `profile` Profile - `__id` string - `__type` string - `contact` Contact - `__id` string - `__type` string - `aim` string - `email` string - `email_domain` string - `email_redacted` string - `fax` string - `geo_location` GeoLocation - … - `icq` string - `jid` string - `msnm` string - `phone` string - `twitter_handle` string - `website` string - `created` string, date-time - `identity` Identity - `__id` string - `__type` string - `dob` string, date-time - `dob_format` string - `first_name` string - `last_name` string - `mmn` string - `name` string - `ssn` string - `language` string - `telegram` TelegramProfile - `name` string - `user_id` integer - `twitter` TwitterProfile - `__id` string - `__type` string - `description` string - `followers_count` integer - `id_str` string - `profile_background_location` InetLocation - … - `profile_banner_location` InetLocation - … - `profile_image_location` InetLocation - … - `protected` boolean - `statuses_count` integer - `user_location` string - `verified` boolean - `publish_ts` string, date-time - `seller` Profile - `__id` string - `__type` string - `contact` Contact - `__id` string - `__type` string - `aim` string - `email` string - `email_domain` string - `email_redacted` string - `fax` string - `geo_location` GeoLocation - … - `icq` string - `jid` string - `msnm` string - `phone` string - `twitter_handle` string - `website` string - `created` string, date-time - `identity` Identity - `__id` string - `__type` string - `dob` string, date-time - `dob_format` string - `first_name` string - `last_name` string - `mmn` string - `name` string - `ssn` string - `language` string - `telegram` TelegramProfile - `name` string - `user_id` integer - `twitter` TwitterProfile - `__id` string - `__type` string - `description` string - `followers_count` integer - `id_str` string - `profile_background_location` InetLocation - … - `profile_banner_location` InetLocation - … - `profile_image_location` InetLocation - … - `protected` boolean - `statuses_count` integer - `user_location` string - `verified` boolean - `service_account` ServiceAccount - `created_at` string, date-time - `login` string - `original_id` string - `password` Password - `encrypted_text` string - `encryption_algorithm` string - `plain_text` string - `profile` Profile - `__id` string - `__type` string - `contact` Contact - … - `created` string, date-time - `identity` Identity - … - `language` string - `telegram` TelegramProfile - … - `twitter` TwitterProfile - … - `security_questions` SecurityQuestion[] - `answer` string - `question` string - `service` Service - `__id` string - `__type` string - `description` string - `geo_location` GeoLocation - … - `id` string - `inet_location` InetLocation - … - `name` string - `software` string - `service_account_info` ServiceAccountInfo - `balance` number, float - `currency` string - `last_transaction_ts` string, date-time - `linked_payment_method_description` string - `points` integer - `shop` Service - `__id` string - `__type` string - `description` string - `geo_location` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - … - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - … - `id` string - `inet_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `name` string - `software` string - `source` string - `timestamp` string, date-time - `title` string - `verification_ts` string, date-time - Tweet - `__id` string - `__type` string - `author` Profile - `__id` string - `__type` string - `contact` Contact - `__id` string - `__type` string - `aim` string - `email` string - `email_domain` string - `email_redacted` string - `fax` string - `geo_location` GeoLocation - … - `icq` string - `jid` string - `msnm` string - `phone` string - `twitter_handle` string - `website` string - `created` string, date-time - `identity` Identity - `__id` string - `__type` string - `dob` string, date-time - `dob_format` string - `first_name` string - `last_name` string - `mmn` string - `name` string - `ssn` string - `language` string - `telegram` TelegramProfile - `name` string - `user_id` integer - `twitter` TwitterProfile - `__id` string - `__type` string - `description` string - `followers_count` integer - `id_str` string - `profile_background_location` InetLocation - … - `profile_banner_location` InetLocation - … - `profile_image_location` InetLocation - … - `protected` boolean - `statuses_count` integer - `user_location` string - `verified` boolean - `body` string - `display_text_range` integer[] - `geo_location` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - `coordinates` LocationPoint[] - `type` string - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - `__id` string - `__type` string - `number` integer - `street` string - `id_str` string - `in_reply_to` string - `ingested` string, date-time - `is_quote` boolean - `language` string - `place` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - `coordinates` LocationPoint[] - `type` string - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - `__id` string - `__type` string - `number` integer - `street` string - `possibly_sensitive` boolean - `quote_count` integer - `quoted_status` NestedTweet - `__id` string - `__type` string - `author` Profile - `__id` string - `__type` string - `contact` Contact - … - `created` string, date-time - `identity` Identity - … - `language` string - `telegram` TelegramProfile - … - `twitter` TwitterProfile - … - `body` string - `display_text_range` integer[] - `geo_location` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - … - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - … - `id_str` string - `in_reply_to` string - `is_quote` boolean - `language` string - `place` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - … - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - … - `possibly_sensitive` boolean - `quote_count` integer - `quotes` string - `recipient` Profile - `__id` string - `__type` string - `contact` Contact - … - `created` string, date-time - `identity` Identity - … - `language` string - `telegram` TelegramProfile - … - `twitter` TwitterProfile - … - `reply_count` integer - `retweet_count` integer - `source` string - `timestamp` string, date-time - `tweet_hashtags` TwitterEntityHashtag[] - `__id` string - `__type` string - `hashtag` string - `indices` integer[] - `tweet_media` TwitterEntityMedia[] - `__id` string - `__type` string - `display_location` InetLocation - … - `expanded_location` InetLocation - … - `indices` integer[] - `inet_location` InetLocation - … - `media_id_str` string - `media_location` InetLocation - … - `media_type` string - `source_status_id_str` string - `tweet_symbols` TwitterEntitySymbol[] - `__id` string - `__type` string - `indices` integer[] - `text` string - `tweet_urls` TwitterEntityUrl[] - `__id` string - `__type` string - `display_location` InetLocation - … - `expanded_location` InetLocation - … - `indices` integer[] - `inet_location` InetLocation - … - `tweet_user_mentions` TwitterEntityMention[] - `__id` string - `__type` string - `indices` integer[] - `mentioned_user` Profile - … - `quotes` string - `recipient` Profile - `__id` string - `__type` string - `contact` Contact - `__id` string - `__type` string - `aim` string - `email` string - `email_domain` string - `email_redacted` string - `fax` string - `geo_location` GeoLocation - … - `icq` string - `jid` string - `msnm` string - `phone` string - `twitter_handle` string - `website` string - `created` string, date-time - `identity` Identity - `__id` string - `__type` string - `dob` string, date-time - `dob_format` string - `first_name` string - `last_name` string - `mmn` string - `name` string - `ssn` string - `language` string - `telegram` TelegramProfile - `name` string - `user_id` integer - `twitter` TwitterProfile - `__id` string - `__type` string - `description` string - `followers_count` integer - `id_str` string - `profile_background_location` InetLocation - … - `profile_banner_location` InetLocation - … - `profile_image_location` InetLocation - … - `protected` boolean - `statuses_count` integer - `user_location` string - `verified` boolean - `reply_count` integer - `retweet_count` integer - `retweeted` string - `retweeted_status` NestedTweet - `__id` string - `__type` string - `author` Profile - `__id` string - `__type` string - `contact` Contact - … - `created` string, date-time - `identity` Identity - … - `language` string - `telegram` TelegramProfile - … - `twitter` TwitterProfile - … - `body` string - `display_text_range` integer[] - `geo_location` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - … - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - … - `id_str` string - `in_reply_to` string - `is_quote` boolean - `language` string - `place` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - … - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - … - `possibly_sensitive` boolean - `quote_count` integer - `quotes` string - `recipient` Profile - `__id` string - `__type` string - `contact` Contact - … - `created` string, date-time - `identity` Identity - … - `language` string - `telegram` TelegramProfile - … - `twitter` TwitterProfile - … - `reply_count` integer - `retweet_count` integer - `source` string - `timestamp` string, date-time - `tweet_hashtags` TwitterEntityHashtag[] - `__id` string - `__type` string - `hashtag` string - `indices` integer[] - `tweet_media` TwitterEntityMedia[] - `__id` string - `__type` string - `display_location` InetLocation - … - `expanded_location` InetLocation - … - `indices` integer[] - `inet_location` InetLocation - … - `media_id_str` string - `media_location` InetLocation - … - `media_type` string - `source_status_id_str` string - `tweet_symbols` TwitterEntitySymbol[] - `__id` string - `__type` string - `indices` integer[] - `text` string - `tweet_urls` TwitterEntityUrl[] - `__id` string - `__type` string - `display_location` InetLocation - … - `expanded_location` InetLocation - … - `indices` integer[] - `inet_location` InetLocation - … - `tweet_user_mentions` TwitterEntityMention[] - `__id` string - `__type` string - `indices` integer[] - `mentioned_user` Profile - … - `source` string - `timestamp` string, date-time - `tweet_hashtags` TwitterEntityHashtag[] - `__id` string - `__type` string - `hashtag` string - `indices` integer[] - `tweet_media` TwitterEntityMedia[] - `__id` string - `__type` string - `display_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `expanded_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `indices` integer[] - `inet_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `media_id_str` string - `media_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `media_type` string - `source_status_id_str` string - `tweet_symbols` TwitterEntitySymbol[] - `__id` string - `__type` string - `indices` integer[] - `text` string - `tweet_urls` TwitterEntityUrl[] - `__id` string - `__type` string - `display_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `expanded_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `indices` integer[] - `inet_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `tweet_user_mentions` TwitterEntityMention[] - `__id` string - `__type` string - `indices` integer[] - `mentioned_user` Profile - `__id` string - `__type` string - `contact` Contact - … - `created` string, date-time - `identity` Identity - … - `language` string - `telegram` TelegramProfile - … - `twitter` TwitterProfile - … - WebContentPublish - `__id` string - `__type` string - `author` Profile - `__id` string - `__type` string - `contact` Contact - `__id` string - `__type` string - `aim` string - `email` string - `email_domain` string - `email_redacted` string - `fax` string - `geo_location` GeoLocation - … - `icq` string - `jid` string - `msnm` string - `phone` string - `twitter_handle` string - `website` string - `created` string, date-time - `identity` Identity - `__id` string - `__type` string - `dob` string, date-time - `dob_format` string - `first_name` string - `last_name` string - `mmn` string - `name` string - `ssn` string - `language` string - `telegram` TelegramProfile - `name` string - `user_id` integer - `twitter` TwitterProfile - `__id` string - `__type` string - `description` string - `followers_count` integer - `id_str` string - `profile_background_location` InetLocation - … - `profile_banner_location` InetLocation - … - `profile_image_location` InetLocation - … - `protected` boolean - `statuses_count` integer - `user_location` string - `verified` boolean - `collection_ts` string, date-time - `inet_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `ingested` string, date-time - `language` string - `links` InetLocation[] - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `raw_text` string - `source` string - `text` string - `timestamp` string, date-time - `title` string - ForumPost - `__id` string - `__type` string - `author` Profile - `__id` string - `__type` string - `contact` Contact - `__id` string - `__type` string - `aim` string - `email` string - `email_domain` string - `email_redacted` string - `fax` string - `geo_location` GeoLocation - … - `icq` string - `jid` string - `msnm` string - `phone` string - `twitter_handle` string - `website` string - `created` string, date-time - `identity` Identity - `__id` string - `__type` string - `dob` string, date-time - `dob_format` string - `first_name` string - `last_name` string - `mmn` string - `name` string - `ssn` string - `language` string - `telegram` TelegramProfile - `name` string - `user_id` integer - `twitter` TwitterProfile - `__id` string - `__type` string - `description` string - `followers_count` integer - `id_str` string - `profile_background_location` InetLocation - … - `profile_banner_location` InetLocation - … - `profile_image_location` InetLocation - … - `protected` boolean - `statuses_count` integer - `user_location` string - `verified` boolean - `board` string - `body` string - `forum` Service - `__id` string - `__type` string - `description` string - `geo_location` GeoLocation - `__id` string - `__type` string - `bbox` GeoShape - … - `city` string - `continent_code` string - `country` string - `country_code` string - `country_code_3` string - `location` string - `postal_code` string - `region` string - `street_address` StreetAddress - … - `id` string - `inet_location` InetLocation - `__id` string - `__type` string - `domain` string - `ips_v4` Ipv4Address[] - `ips_v6` Ipv6Address[] - `path` string - `port` integer - `protocol` string - `url` string - `name` string - `software` string - `in_reply_to` string - `ingested` string, date-time - `message_id` string - `original_id` string - `post_date` string, date-time - `source` string - `subject` string - `timestamp` string, date-time - `topic_id` string - DomainDiscovery - `__id` string - `__type` string - `domain` string - `domain_whois` DomainWhois - `__id` string - `__type` string - `created` string, date-time - `domain` string - `expires` string, date-time - `nameservers` Domain[] - `raw_text` string - `registrant` Profile - `__id` string - `__type` string - `contact` Contact - … - `created` string, date-time - `identity` Identity - … - `language` string - `telegram` TelegramProfile - … - `twitter` TwitterProfile - … - `registrar` Profile - `__id` string - `__type` string - `contact` Contact - … - `created` string, date-time - `identity` Identity - … - `language` string - `telegram` TelegramProfile - … - `twitter` TwitterProfile - … - `source` string - `statuses` string[] - `timestamp` string, date-time - `updated` string, date-time - `ingested` string, date-time - `rr` DnsRr[] - `__id` string - `__type` string - `priority` integer - `rdata_domain` string - `rdata_ipv4` string, ip - `type` string - `similar_domains` Domain[] - `source` string - `timestamp` string, date-time - `doc_matches` DocMatch[], required: Any document matches generated for this alert. - `locations` Location[], required: A list of locations for the match. - `match_path` string - `offsets` integer[], required: The offsets in the raw document where the value was identified. - `value` string, required: The value that was identified. - `match_path` string, required: The JSON field path of the match. - `doc_url` string, uri, required: The URL to the document that triggered this alert. - `email_sent_at` string: If email notifications are used for this alert, the timestamp the alert email was sent. - `has_analysis` boolean: True if the alert has analysis text or file attachments and false otherwise. - `id` string, required: The ID of the alert. - `indicator_attributions` IndicatorAttribution[], required - `id` string, required - `name` string, required - `type` string, required - `indicator_mscore` integer - `label_matches` LabelMatch[], required: Any labels that matched for this alert. - `label_id` string, required: The ID of the identified label that was matched. - `value` string, required: The label value that was matched. - `labels` Label[]: The labels itentified in the document that triggered this alert. - `classifier` string, required: The classifier that identified this label. - `confidence` integer, required: The confidence estimate that the label was identified properly. - `element_path` string, required: The JSON field path in the raw document where the label was identified. - `id` string, required: The ID of the label. - `label` string, required: The label value. - `version` string, required: The version of the classifier that identified this label. - `labels_url` string, uri, required: The URL to the labels identified in the document that triggered this alert. - `meets_password_policy` boolean: If the monitor that created the alert includes a password policy, this value indicates if the alert (when applicable) has a password that meets the policy. - `monitor_id` string, required: The ID of the monitor that generated this alert. - `monitor_name` string: The name of the monitor that generated this alert. - `monitor_version` integer, required: The version of the monitor that generated this alert. - `relevance_class` 'benign' | 'malicious': The relevance class suggested for this alert. - `relevance_probability` number: The relevance probability suggested for this alert. - `status` 'new' | 'closed' | 'read' | 'escalated' | 'in_progress' | 'no_action_required' | 'duplicate' | 'not_relevant' | 'tracked_external', required: The status of this alert. - `tags` string[]: The tags set for this alert. - `title` string, required: The title of this alert. - `topic_matches` TopicMatch[], required: Any topic matches the monitor generated for this alert. - `topic_id` string, required: The ID of the topic corresponding to this match. - `value` string, required: The value of the topic that matched. - `topics` Topic[]: The topics that were identified in the document that triggered this alert. - `confidence` integer, required: The estimated confidence that the value was properly idenitified. - `entity_locations` EntityLocation[], required: The locations of the identified entities. - `element_path` string, required: The JSON field path at which the entity was found in the raw document. - `offsets` integer[], required: The list of offsets where the entity was found in the element_path. - `extractor` string, required: The name of the extractor that identified the topic value. - `id` string, required: The ID of the identified topic. - `type` string, required: The type of the topic. - `value` string, required: The value identified for the topic. - `version` string, required: The version of the extractor. - `topics_url` string, uri, required: The URL to the toics identified in the document that triggered this alert. - `updated_at` string, required: The time this alert was last updated at. ## Other responses - `400`: Bad Request - `401`: Unauthorized - `500`: Internal Server Error --- [API](https://skmtc.dev/virustotal/apis/dtm-digital-threat-monitoring.md) - [All operations](https://skmtc.dev/virustotal/apis/dtm-digital-threat-monitoring/llms.txt) - [OpenAPI document](https://skmtc.dev/virustotal/apis/dtm-digital-threat-monitoring/revisions/ba27db660651?raw)