selection criteria for alerts in API call to https://api.ca.prismacloud.io/v2/alert

[SIurenko]

Hi,

   I'm using a call to CSPM Prisma API https://api.ca.prismacloud.io/v2/alert to get changes happened to alerts withing specific time range. For that absolute timeRange filter is used in call parayers with specific stratTime and endTime values set as described in API documentation here https://pan.dev/prisma-cloud/api/cspm/post-alerts-v-2/. In general, the call works and returns a list of alerts with details. But I discovered that all of the alerts I get in the result data set are in status 'open' unless the alert was both opened and closed (dismissed, resolved) within the specified timeRange. In case when the alert was opened before the timeRange and resolved within timeRange it is not included in the result set. Is it expected behavior? Can it be altered to get all alerts that changed the status within timeRange by some call parameters or alert configuration?

Kind regards,

Sergii

[JNeytchev]

Hi Sergii,

At a first look, this sounds like the expected behavior, to us a "change" means going from {never opened,open} to {dismissed,snoozed,resolved} within a time interval.

However, let me take a closer look, can you reply with an example of retrieved alerts that demonstrate the problem, together with the query parameters you used?