VIvirustotal
DTM Alerts

Get an existing alert by its ID

get/alerts/{id}

Request

  • Base URL
    https://www.virustotal.com/api/v3/dtm
  • URL
    https://www.virustotal.com/api/v3/dtm/alerts/{id}
  • Auth
    none required

Path parameters

idstring required
Example:c4huif0mhcmiku5g7jsg

The ID of the alert.

Query parameters

truncateinteger

Truncates document fields to the given length using unicode ellipsis (\x2026) to indicate truncation

refsboolean

If true, the alert response will include its triggering doc, topics, and labels in the response JSON.

sanitizeboolean

If true, any HTML content in the alert is sanitized to ensure it does not potentially contain malicious tags. If not used, be careful when rendering/using the alert/doc content. This param can also be specified as a json path in the document to sanitize and may be repeated in this case.

Headers

x-apikeystring required

Your API key

Response

OK

aggregated_added_atstring date-time

Only applicable to alert buckets, this field is the timestamp at which the most recent child alert was aggregated into the bucket.

aggregated_alert_countinteger

Only applicable to alert buckets, and indicates the number of alerts aggregated into this bucket alert.

aggregated_alert_count_newinteger

Only applicable to alert buckets, and indicates the number of alerts with new status in this bucket alert.

aggregated_under_idstring

Only applicable to child alerts that are aggregated into a bucket, this field is the ID of the parent bucket alert.

ai_doc_summarystring

If the group has the AI features enabled, this field will contain the AI analysis summary.

alert_summarystring required

The summary of the alert.

alert_type'Compromised Credentials' | 'Domain Discovery' | 'Forum Post' | 'Message' | 'Paste' | 'Shop Listing' | 'Tweet' | 'Web Content' required

The type of this alert.

analysisstring

If analysis has been added to the alert, then this property contains the analysis text.

created_atstring required

The time this alert was created at.

doc_urlstring uri required

The URL to the document that triggered this alert.

email_sent_atstring

If email notifications are used for this alert, the timestamp the alert email was sent.

has_analysisboolean

True if the alert has analysis text or file attachments and false otherwise.

idstring required

The ID of the alert.

indicator_mscoreinteger
labels_urlstring uri required

The URL to the labels identified in the document that triggered this alert.

meets_password_policyboolean

If the monitor that created the alert includes a password policy, this value indicates if the alert (when applicable) has a password that meets the policy.

monitor_idstring required

The ID of the monitor that generated this alert.

monitor_namestring

The name of the monitor that generated this alert.

monitor_versioninteger required

The version of the monitor that generated this alert.

relevance_class'benign' | 'malicious'

The relevance class suggested for this alert.

relevance_probabilitynumber

The relevance probability suggested for this alert.

status'new' | 'closed' | 'read' | 'escalated' | 'in_progress' | 'no_action_required' | 'duplicate' | 'not_relevant' | 'tracked_external' required

The status of this alert.

tagsstring[]

The tags set for this alert.

titlestring required

The title of this alert.

topics_urlstring uri required

The URL to the toics identified in the document that triggered this alert.

updated_atstring required

The time this alert was last updated at.

Changes

No recorded changes to this operation across all 1 revision of this API.