Common Alert Structure

root_scope_id

string

Scope Id corresponding to top scope in scope hierarchy.

key_id

string

id field used for determining ‘similar’ alerts. Identical key_id’s can be snoozed.

type

string

Type of the alert. Fixed set of string values: COMPLIANCE, USERAPP, FORENSICS, ENFORCEMENT, SENSOR, PLATFORM, FEDERATION, CONNECTOR

event_time

long

timestamp of when the event triggered (or if event spanned a range, then the beginning of the range). This timestamp is in epoch milliseconds (UTC).

alert_time

long

Timestamp of when the alert was first attempted to be sent. This will be after the timerange of the event. This timestamp is in epoch milliseconds (UTC).

alert_text

string

Title of the alert.

alert_text_with_names

string

Same content as alert_text but with any id fields replaced by corresponding name. This field may not exist for all alerts.

severity

string

Fixed set of string values: LOW, MEDIUM, HIGH, CRITICAL, IMMEDIATE_ACTION.This is the severity of the alert. For some types of alerts these values are configurable.

alert_notes

string

Usually not set. May exist in some special cases for passing additional information through Kafka DataTap.

alert_conf_id

string

id of the alert configuration that triggered this alert. May not exist for all alerts.

alert_details

string

Structured data. Stringified json. See feature details for specific alert type, since the exact structure of this field varies based on the type of alert.

alert_details_json

json

Same content of alert_details, but not stringified. Only present for compliance alerts, and only available through Kafka.

tenant_id

string

May contain vrf corresponding to root_scope_id. Or may contain 0 as the default value. Or may not be present at all.

alert_id

string

Internal generated temporary id. Best ignored.

alert_name

string

Name of the alert.