See Query filters for reference on filter syntax, and review the filter examples below.
Fields supported by alerts.list
Filter fields | |
---|---|
alertId |
Should be used to filter alerts based on alert id.
Corresponding value should be of type: |
type |
Should be used to filter alerts based on alert type.
Corresponding value should be of type: |
source |
Should be used to filter alerts based on alert source.
Corresponding value should be of type: |
createTime |
Should be used to filter alerts based on alert creation time. Corresponding value should be of type: |
startTime |
Should be used to filter alerts based on alert start time. Corresponding value should be of type: |
endTime |
Should be used to filter alerts based on alert end time. Corresponding value should be of type: |
List query examples
- To query for all alerts created on or after April 5, 2018:
createTime >= "2018-04-05T00:00:00Z"
- To query for all alerts from the source "Gmail phishing":
source:"Gmail phishing"
- To query for all alerts that started in 2017:
startTime >= "2017-01-01T00:00:00Z&" AND startTime < "2018-01-01T00:00:00Z"
- To query for all user-reported phishing alerts from the source "Gmail phishing":
type:"User reported phishing" source:"Gmail phishing"
Fields supported by alerts.feedback.list
Filter fields | |
---|---|
alertId |
Should be used to filter alert feedback based on alert id.
Corresponding value should be of type: |
feedbackId |
Should be used to filter alert feedback based on feedback id.
Corresponding value should be of type: |
Feedback list query examples
- To query feedback of alerts with ids
alertId01
oralertId02
:
alertId = alertId01 OR alertId = alertId02
- To query feedback of an alert
alertId01
with feedback idfeedbackId01
:
alertId = alertId01 AND feedbackId = feedbackId01