Feedback:

cs_get_alert_entities

Note:  

  • Access to this operator is provided on a limited-availability basis. Contact Anomali Customer Support for more information.

  • The cs_get_alert_entities operator replaces the cs_get_detect_summaries operator, which is now deprecated. See Migration for details.

Use the cs_get_alert_entities operator to retrieve full alert details by a composite ID.

Syntax

| cs_get_alert_entities cs_id_list=<composite_ids>_or_<field_reference> [cs_include_hidden=<boolean>]

cs_id_list=<composite_ids>_or_<field_reference>

Specify composite IDs or a field reference.

<composite_ids> is either a single composite ID or a comma-separated list of composite IDs, without spaces, and enclosed in double quotes.

<field_reference> is the resources array with composite IDs returned in the output of the cs_query_alerts operator.

See cs_query_alerts for more information.
cs_include_hidden=<boolean>

Optional. Specify whether to include hidden alerts.

Possible values:

  • true

  • false

Default value: true

Examples

Example 1: Retrieve alert details using a specific composite ID.

Copy 
| cs_get_alert_entities cs_id_list="ldt:abc123:1001"

 

Example 2: Retrieve alert details of two composite IDs.

Copy 
| cs_get_alert_entities cs_id_list="ldt:xyz345:1002,ldt:ntp584:3456"

 

Example 3: Query and filter new alerts, store them in resources, and pipe the results to retrieve their full details. For more information on resources, see cs_query_alerts.

Copy 
| cs_query_alerts cs_filter="status:'new'" | cs_get_alert_entities cs_id_list=resources

Migration

The cs_get_detect_summaries operator is deprecated and replaced by cs_get_alert_entities.

If you currently use the cs_get_detect_summaries operator to retrieve full alert details, use the following example to correctly migrate your existing queries to the cs_get_alert_entities operator:

Before After
| cs_get_detect_summaries cs_id_list="id1,id2" | cs_get_alert_entities cs_id_list="id1,id2"