Actions15
- Active Response Actions
- Agent Actions
- Decoder Actions
- Indexer Actions
- Rule Actions
- Security Event Actions
- Vulnerability Actions
Security Event → Search Alerts
AI-generatedSummary
Searches for security event alerts in the Wazuh Indexer by querying alert documents using either a user-built filter form or raw OpenSearch query DSL.
Inputs
- Index Pattern (required) — Specify the Wazuh Indexer alert index pattern to search, typically "wazuh-alerts*".
- Query Mode (required) — Choose how to construct the search query: either build it from individual filter fields or provide a complete OpenSearch DSL query JSON.
- Filters — When using "Build From Fields" mode, specify criteria such as agent ID, rule ID, rule level range, timestamp bounds, and a query string expression to filter alerts.
- Query JSON — When using "Use Query DSL" mode, provide a JSON object representing the OpenSearch query DSL to send directly to the indexer search endpoint.
- Size — Maximum number of matching alert documents to return (default 100).
- From — Number of matching alert documents to skip for pagination (default 0).
- Sort Field — When building from fields, specify the alert document field to sort results by (default "@timestamp").
- Sort Order — When building from fields, choose ascending or descending sort order (default descending).
Output shape
a list of alert documents matching the search criteria
The output is normalized search results from the Wazuh Indexer, including alert document details, total hits, and optional paging metadata. Results shape conforms to normalized OpenSearch search response documents.