Get Alert

Get an alert by its name.

Required Scope: https://www.googleapis.com/auth/cloud-platform.

Required IAM Permission on the name resource: threatintelligence.alerts.get.

External Documentation

To learn more, visit the Google Threat Intelligence documentation.

​

Parameters

Parameter	Description
Alert Name	The name of the alert, as returned by the List Alerts action. For Example: projects/my-gti-project/alerts/6f1c2a9e-3b7d-4e52-9a10-2c8d4f7b1e03

​

Example Output

{
	"name": "projects/my-gti-project/alerts/6f1c2a9e-3b7d-4e52-9a10-2c8d4f7b1e03",
	"findings": [
		"projects/my-gti-project/findings/0b9e4d21-7c3a-4f68-8e55-1a2b3c4d5e6f"
	],
	"state": "NEW",
	"audit": {
		"createTime": "2026-10-20T08:14:22.512Z",
		"updateTime": "2026-10-21T11:03:47.090Z",
		"creator": "system",
		"updater": "[e-mail]"
	},
	"displayName": "Credentials for example.com found in a data leak",
	"detail": {
		"detailType": "data_leak",
		"dataLeak": {
			"severity": "HIGH",
			"discoveryDocumentIds": [
				"doc-8f2e1c7a9b"
			]
		}
	},
	"etag": "W/\"a1b2c3d4\"",
	"aiSummary": "Employee credentials for example.com were posted to a paste site.",
	"relevanceAnalysis": {
		"relevant": true,
		"confidence": "CONFIDENCE_LEVEL_HIGH",
		"reasoning": "The leaked credentials belong to the example.com domain, which is in scope.",
		"evidence": {
			"commonThemes": [
				"example.com"
			],
			"distinctThemes": []
		},
		"relevanceLevel": "RELEVANCE_LEVEL_HIGH"
	},
	"severityAnalysis": {
		"severityLevel": "SEVERITY_LEVEL_HIGH",
		"confidence": "CONFIDENCE_LEVEL_MEDIUM",
		"reasoning": "The credentials include plaintext passwords."
	},
	"priorityAnalysis": {
		"priorityLevel": "PRIORITY_LEVEL_HIGH",
		"confidence": "CONFIDENCE_LEVEL_MEDIUM",
		"reasoning": "High relevance and high severity."
	},
	"findingCount": "1",
	"configurations": [
		"projects/my-gti-project/configurations/2d7a9c41-5e3b-4f80-b1c2-9e8d7f6a5b4c"
	]
}