How to get one month alert report from insight IDR

Hello team,

I would like to download one month alert for reporting purposes. I need the report in CSV or pdf format. is it possible to get the report?

Are you just wanting a list of all the alerts that fired? Or are you looking for the investigations that were created?

Hi john,

I want all the alerts which are fired for the day/week/Month with different attributes alert time, name, alert assignee and more. Is it possible to get it in CSV format?

Kindly share the procedure with me.
Thanks in advance.

I don’t think we have a specific report for that nor do we have anything through the API unfortunately. We do have options at the investigation level though.

For investigations we have the ability through the API to pull them and look for alerts associated with an investigation. Maybe with a little python scripting you could pull all the investigation and their IDs and then pass that into the next call for all the alerts associated.

But there’s nothing currently straight out of the box to achieve what you’re looking for.

Hi Ngadam,
currently it is not possible from the dashboard, but through the API I obtained a daily report (PDF and CSV) of all the Investigations.

However, I made a request to support to implement this feature, currently there is the IDEA-13242.

I hope it will be implemented soon and hope it helps you.

1 Like

I +1 on that.

Currently, we needed to pull in a CSV report based on the API v1 and v2 on the same investigation period and then merge it out to complete the report since there are data that are only available in v1 and only available for v2 hence the complicated setup.

Hope your idea will be picked up.

Hello dpanetta,
Can you please share the procedure of API for a daily report?