Palo Alto Networks Alerts API
Prisma Cloud generates an alert when it detects a violation in a policy that is included in an active alert rule. You can use the API requests to manage alerts, including listing or viewing, snoozing or dismissing, reopening, or remediating alerts. When retrieving a list of alerts through an API request, you can set filters, time range parameters, or pagination parameters. ### Pagination You can limit the number of items in a response list from API resources that support pagination. Version 2 (V2) of the API requests to list alerts supports pagination and will accept the following request parameters. Request Parameter | Description -----------| ------- **limit** | Maximum number of items to return per page. Without pagination, maximum number of items to return in a response. **offset** | Number of items to skip before selecting items to return. Default is zero. **pageToken** | Set to the **nextPageToken** value from the previous response object to return the next page of data. ### Filters API requests that use POST methods to request a list of alerts have filter parameters that enable you to narrow your request to alerts that meet a certain criteria.The [List Alert Filters](/prisma-cloud/api/cspm/get-alert-filter-options) requests return the available filters.
Operations 37
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
POST
/alerts/get_alerts
Search detections across endpoint, network and cloud · Palo Alto Networks Get Alerts
#
Ask an LLM
“Can I pull endpoint, network and cloud detections filtered by severity and category in one request?”
“Which detections came in from my endpoints in the last day, filtered by alert ID or timestamp?”
Tell an agent
Get the endpoint, network and cloud detections that match filter {request_data}.
Pull every high-severity detection from endpoint, network and cloud sources raised since yesterday.
POST
/alert/v1/policy
Page through policies with their alert counts · Return policy with alert count
#
Ask an LLM
“Which policies have the most open alerts right now, using the newer paginated policy endpoint?”
“Can I get each policy with its alert count and a next-page token for the following batch?”
Tell an agent
List policies with their alert counts for time range {time_range}, {size} per page.
Fetch the next page of policies with alert counts using token {next_page_token}.
Ask an LLM
“Can I bucket my alert counts by a policy field such as severity or policy type?”
“What does my alert volume look like when grouped by a policy attribute of my choosing?”
Tell an agent
Aggregate alert counts grouped by policy field {group_by}.
Group alerts by {group_by} for time range {time_range} and show the count in each group.
Ask an LLM
“Can I get the evidence behind an alert as graph data I can draw?”
“Is there a way to visualise how the resources in an alert connect, in JSON Graph Format?”
Tell an agent
Get the evidence graph for alert {id}.
Return the JSON Graph Format evidence data for alert {id} so I can render it.
POST
/alerts/api/v1/notification/ondemand
Send an on-demand notification for an alert · Create On Demand Notification
#
Ask an LLM
“Can I push a single alert to Jira, email or Slack right now instead of waiting for a rule?”
“Which channels can I send an on-demand alert notification to?”
Tell an agent
Send an on-demand notification for alert {alert_id} using config {config}.
Open a Jira ticket for alert {alert_id} with notification settings {config}.
Ask an LLM
“What filters can I use when querying cloud alerts?”
“Which alert filter keys exist and what are their default options?”
Tell an agent
Show me every alert filter key and its default or recently used options.
List the alert filters I can apply to an alert search.
POST
/filter/alert/suggest
Autocomplete values for an alert filter · List Alert Filter Autocomplete Suggestions
#
Ask an LLM
“What values can I pick for a specific alert filter like cloud.region?”
“Can I type part of a value and get matching suggestions for an alert filter?”
Tell an agent
Suggest values for alert filter {filter_name}.
Autocomplete alert filter {filter_name} with values containing {query}.
Ask an LLM
“Can I list Prisma Cloud alerts with query-string filters using the original v1 endpoint?”
“Is the original GET alert list capped at 10,000 results?”
Tell an agent
Using the v1 GET alert list, show alerts from the last {time_amount} {time_unit} with time type {time_type}, detailed {detailed}.
v1 GET list: {alert_status} alerts, severity {severity}, last {time_amount} {time_unit} ({time_type}, detailed {detailed}).
Ask an LLM
“Can I post a filter body to list cloud alerts with the v1 endpoint and pick only certain fields?”
“What happens when the v1 POST alert list passes 10,000 results?”
Tell an agent
Post filters {filters} to the v1 alert list and return alerts for time range {time_range}.
Using the v1 POST alert list, return only fields {fields} for alerts matching {filters}.
Ask an LLM
“Can I page past 10,000 alerts using query parameters and a page token?”
“Does the v2 GET alert list include alert rules in its response?”
Tell an agent
Page through v2 alerts from the last {time_amount} {time_unit} ({time_type}, detailed {detailed}), starting at token {page_token}.
Via the v2 GET list, show alerts on cloud account {account} from the last {time_amount} {time_unit} ({time_type}, detailed {detailed}).
Ask an LLM
“Can I send a JSON filter body and page through more than 10,000 alerts with a page token?”
“Which v2 POST alert list option lets me choose the fields returned for each alert?”
Tell an agent
Post filters {filters} to the v2 alert list and continue from page token {page_token}.
Using the v2 POST alert list, return {limit} alerts matching {filters} sorted by {sort_by}.
Ask an LLM
“How many alerts does each policy have, filtered with query parameters?”
“Can I see alert counts per policy just for one cloud type using a GET request?”
Tell an agent
Count alerts per policy for cloud type {cloud_type} using the GET grouping.
Show per-policy alert counts for compliance standard {standard} via query parameters.
Ask an LLM
“Can I post a filter body and get back alert counts grouped by policy?”
“Which policies are generating alerts in a given time range, counted with a POST filter?”
Tell an agent
Post filters {filters} and return alert counts grouped by policy.
Give me per-policy alert counts for time range {time_range} using a POST body.
Ask an LLM
“What are the full details of one Prisma Cloud alert when I have its ID?”
“What rate limit applies when fetching a single alert's info?”
Tell an agent
Get the details of alert {id}.
Show detailed information for alert {id} with detailed set to {detailed}.
Ask an LLM
“Can I snooze alerts for a period instead of dismissing them outright?”
“What do I need to send to dismiss a batch of alerts with a note?”
Tell an agent
Dismiss alerts {alerts} matching filter {filter} with note {note}.
Snooze all alerts for policies {policies} matching {filter} for {snooze_range}.
GET
/alert/dismiss/require_dismissal_note
Check whether dismissing requires a note · Is Dismissal Note Required
#
Ask an LLM
“Do users have to give a reason when they dismiss an alert in my tenant?”
“Is a dismissal note currently mandatory for alerts?”
Tell an agent
Tell me whether a dismissal note is required when dismissing alerts.
Check the current dismissal-note requirement setting.
PUT
/alert/dismiss/require_dismissal_note
Require or stop requiring a dismissal note · Update Dismissal Note Requirement
#
Ask an LLM
“Can I force everyone to enter a reason before dismissing an alert?”
“How do I turn off the mandatory dismissal note for alerts?”
Tell an agent
Set the dismissal note requirement to {required}.
Make a dismissal note mandatory for every alert dismissal.
Ask an LLM
“Can I set alerts I dismissed or snoozed back to open?”
“What's needed to reopen every snoozed alert for a policy?”
Tell an agent
Reopen alerts {alerts} matching filter {filter}.
Set every dismissed alert for policies {policies} matching {filter} back to open.
Ask an LLM
“How many open alerts do I have in total?”
“Can I get just the number of dismissed or snoozed alerts without listing them?”
Tell an agent
Count my alerts with status {status}.
Give me the total number of {status} alerts.
Ask an LLM
“Can I export a large alert list as a downloadable JSON file in the background?”
“Do sortBy, limit and pageToken apply when I submit an alert JSON export job?”
Tell an agent
Submit a JSON export job for alerts matching {filters} in time range {time_range}.
Kick off a background job that builds a JSON alert list with fields {fields}.
Ask an LLM
“Is my alert JSON export job finished yet?”
“What status is the alert list job I submitted earlier in?”
Tell an agent
Check the status of alert JSON export job {id}.
Tell me whether alert list job {id} is ready to download.
Ask an LLM
“Where do I fetch the JSON alert list once the export job completes?”
“Can I download the results of an alert list job as JSON?”
Tell an agent
Download the JSON alert list produced by job {id}.
Fetch the finished alert export from job {id} in JSON.
Ask an LLM
“Can I get my alerts as a CSV file for a spreadsheet?”
“How do I generate an alert CSV for a filtered set of alerts?”
Tell an agent
Submit a CSV generation job for alerts matching {filters}.
Start a CSV export of alerts for time range {time_range}.
Ask an LLM
“Has my alert CSV finished generating?”
“What state is the alert CSV job I kicked off in?”
Tell an agent
Check the status of alert CSV job {id}.
Tell me if the alert CSV for job {id} is ready.
Ask an LLM
“Where can I download the alert CSV once it's generated?”
“Can I grab the finished alert CSV file for a job?”
Tell an agent
Download the alert CSV produced by job {id}.
Save the CSV alert list from job {id}.
POST
/alert/policy/jobs
Start a job listing alerts grouped by policy · Submit Job to List Alerts By Policy
#
Ask an LLM
“Can I run a background job that lists alerts grouped by the policy they violated?”
“Is there an async export of alerts organised per policy?”
Tell an agent
Submit a job that lists alerts grouped by violated policy for filters {filters}.
Start an async per-policy alert listing for time range {time_range}.
GET
/alert/policy/jobs/{id}/status
Check a per-policy alert job's status · Get Policy Alert Job Status
#
Ask an LLM
“Is my alerts-by-policy job done?”
“What's the status of the job I submitted to group alerts by policy?”
Tell an agent
Check the status of alerts-by-policy job {id}.
Tell me whether policy alert job {id} has completed.
GET
/alert/policy/jobs/{id}/download
Download per-policy alert results as JSON · Download Policy Alerts JSON
#
Ask an LLM
“Where do I download the alerts-grouped-by-policy results?”
“Can I fetch the JSON output of a per-policy alert job?”
Tell an agent
Download the per-policy alert JSON from job {id}.
Fetch the alerts-by-policy results for job {id}.
POST
/alert/remediation
Generate remediation commands for alerts · List Alert Remediation Commands
#
Ask an LLM
“What CLI commands would fix the misconfigurations behind these alerts?”
“Can I get fully constructed remediation commands for alerts on a remediable policy?”
Tell an agent
Generate remediation commands for alerts {alerts} matching filter {filter}.
Show the remediation commands for policies {policies} within filter {filter}.
Ask an LLM
“Can Prisma Cloud fix the issue behind an alert for me?”
“Which alerts can be auto-remediated, and how do I trigger it?”
Tell an agent
Remediate alert {id}.
Run the remediation for alert {id} on its remediable policy.
GET
/policy/api/v1/fetch/remediation/{policyId}
Get AI-assisted remediation for a policy · Get Policy Remediation
#
Ask an LLM
“Is there AI-assisted guidance on how to fix a policy violation on a specific asset?”
“What recommendation steps are available to mitigate a policy's finding?”
Tell an agent
Get AI-assisted remediation for policy {policy_id} on asset {asset_id} for alert {alert_id}.
Show the recommended fix steps for policy {policy_id}, asset {asset_id}, alert {alert_id}.
PATCH
/v1/alerts/id/{id}/status/{status}
Update a data detection (DDR) alert's status · Update Alert Status
#
Ask an LLM
“Can I change the status of a data detection and response alert?”
“What's the call to mark a DDR alert as resolved?”
Tell an agent
Set DDR alert {id} to status {status}.
Mark data detection alert {id} as {status} using API key {api_key}.
Ask an LLM
“Which data detection and response alerts fired on my cloud assets this week?”
“Can I filter DDR alerts by asset name, policy severity or cloud provider?”
Tell an agent
List DDR alerts with policy severity {severity}.
Show DDR alerts on assets whose name contains {asset}, page {page}.
Ask an LLM
“What alerts has IoT Security raised about anomalous device behaviour?”
“Can I list only unresolved IoT device alerts within a time window?”
Tell an agent
List IoT Security alerts for customer {customer_id}.
Show IoT alerts for customer {customer_id} between {start} and {end} with resolved {resolved}.
Ask an LLM
“Which device was affected by an IoT alert, and what response is recommended?”
“Can I see the timeline for a single IoT Security alert?”
Tell an agent
Get IoT alert {id} for customer {customer_id}.
Show the affected device and recommended actions for IoT alert {id} under customer {customer_id}.
PUT
/alert/update
Resolve or unresolve an IoT Security alert · Palo Alto Networks Update Alert Status
#
Ask an LLM
“Can I mark an IoT device alert as resolved and record why?”
“Are resolved IoT alerts kept for later analysis?”
Tell an agent
Mark IoT alert {id} for customer {customer_id} as resolved {resolved} with reason {reason}.
Set IoT alert {id} for customer {customer_id} to resolved {resolved}.
GET
/dspm/api/v1/alerts
List data security (DSPM) alerts · Palo Alto Networks List Data Security Alerts
#
Ask an LLM
“Which alerts flag sensitive data exposure, such as a data store that became public?”
“Can I filter data security alerts by severity and cloud provider?”
Tell an agent
List data security alerts with severity {severity} and status {status}.
Show sensitive-data exposure alerts on {cloud_provider} since {start_time}.