LiteSOC icon

LiteSOC

Track security events and manage alerts with LiteSOC. Severity is automatically assigned based on event type.

Actions7

Alert → Get Many

AI-generated

Summary

Retrieve multiple security alerts from LiteSOC, optionally filtered by alert type, severity, and status, returning either all matching alerts or up to a specified limit.

Inputs

  • Return All — Boolean toggle to return all matching alerts or limit the number returned.
  • Limit — Maximum number of alerts to return if 'Return All' is false. Default is 100; max 500 for Enterprise accounts, max 200 for Pro.
  • Filters — Collection of optional filters to narrow results by Alert Type (e.g., Brute Force Attack, Data Exfiltration), Severity (low, medium, high, critical), and Status (open, acknowledged, resolved, dismissed).

Output shape

a list of alert objects

Each alert object includes fields such as id (UUID), trigger_event_id, severity (auto-assigned critical/high/medium/low), forensics data (network and location info for Pro+ tiers), alert_type, status, title, description, source_ip, actor_id, created_at, updated_at, and metadata. The results can be paginated or returned fully depending on the 'Return All' parameter and the specified limit.

Examples

Example 1: Fetch all critical alerts related to privilege escalation

Set 'Return All' to true; set 'Filters' with Severity as 'critical' and Alert Type as 'privilege_escalation'.

Example 2: Fetch up to 50 open alerts of any type with medium or higher severity

Set 'Return All' to false; set 'Limit' to 50; set 'Filters' with Status as 'open' and Severity as 'medium' or 'high' or 'critical'.

Links

Discussion