https://www.googleapis.com/auth/cloud-platform.
Required IAM Permission on the parent’s resource: threatintelligence.alerts.list.
External DocumentationTo learn more, visit the Google Threat Intelligence documentation.
Parameters
| Parameter | Description |
|---|---|
| Filter | A filter expression to select the alerts to return. Commonly used fields include state, audit.create_time, detail.detail_type, severityAnalysis.severity_level and priorityAnalysis.priority_level.For Example: state = "NEW" OR state = "TRIAGED"For more information about the supported fields, refer to Google Threat Intelligence documentation. |
| Order By | A comma-separated list of fields to sort the alerts by. Add desc after a field to sort it in descending order. The supported fields are the same as in Filter.For Example: audit.create_time desc, severityAnalysis.severity_level desc |
| Page Size | The maximum number of alerts to return per page. Values can range from 1 to 1000. Defaults to 100. |
| Page Token | The nextPageToken value returned by a previous call, used to get the next page of alerts. |
| Return All Pages | Automatically fetch all resources, page by page. |
Example Output
{
"alerts": [
{
"name": "projects/my-gti-project/alerts/6f1c2a9e-3b7d-4e52-9a10-2c8d4f7b1e03",
"findings": [
"projects/my-gti-project/findings/0b9e4d21-7c3a-4f68-8e55-1a2b3c4d5e6f"
],
"state": "NEW",
"audit": {
"createTime": "2026-10-20T08:14:22.512Z",
"updateTime": "2026-10-21T11:03:47.090Z",
"creator": "system",
"updater": "analyst@example.com"
},
"displayName": "Credentials for example.com found in a data leak",
"detail": {
"detailType": "data_leak",
"dataLeak": {
"severity": "HIGH",
"discoveryDocumentIds": [
"doc-8f2e1c7a9b"
]
}
},
"etag": "W/\"a1b2c3d4\"",
"aiSummary": "Employee credentials for example.com were posted to a paste site.",
"relevanceAnalysis": {
"relevant": true,
"confidence": "CONFIDENCE_LEVEL_HIGH",
"reasoning": "The leaked credentials belong to the example.com domain, which is in scope.",
"evidence": {
"commonThemes": [
"example.com"
],
"distinctThemes": []
},
"relevanceLevel": "RELEVANCE_LEVEL_HIGH"
},
"severityAnalysis": {
"severityLevel": "SEVERITY_LEVEL_HIGH",
"confidence": "CONFIDENCE_LEVEL_MEDIUM",
"reasoning": "The credentials include plaintext passwords."
},
"priorityAnalysis": {
"priorityLevel": "PRIORITY_LEVEL_HIGH",
"confidence": "CONFIDENCE_LEVEL_MEDIUM",
"reasoning": "High relevance and high severity."
},
"findingCount": "1",
"configurations": [
"projects/my-gti-project/configurations/2d7a9c41-5e3b-4f80-b1c2-9e8d7f6a5b4c"
]
}
],
"nextPageToken": "CiAKGjBpNDd2Nmp2Zml2cXRwYjBpOXA"
}