Skip to main content

Feed alerts into a SIEM

The alerts feed is the entry point for most integrations. Poll it on a schedule, dedup the results, and load them into your SIEM.

Endpoints​

OperationEndpoint
Poll new alerts (v2 payload)GET /v2/incidents/alerts
Poll new alerts (v1 payload)GET /incidents/alerts
Backfill up to 30 daysGET /incidents/historic/alerts, GET /v2/incidents/historic/alerts

Poll the feed​

curl -s "https://api.cloudsek.com/v2/incidents/alerts?limit=50&page=1" \
  -H "Authorization: Bearer $TOKEN"

The response is paginated:

{
  "data": [ { "...": "alert documents" } ],
  "current_limit": 50,
  "total_count": 1204,
  "current_count": 50,
  "total_page": 25,
  "current_page": 1
}

Each alert document carries the event details plus an embedded incident_details block. That block's incident_id is the incident Display ID (XVA-...), which is exactly what the write routes take. You can go from an alert to a write-back with no other lookup.

Practical notes​

  • Page to the end. Walk pages until current_page reaches total_page. With the 20 requests per minute read budget, pace page fetches about 3 seconds apart.
  • Dedup on alert_id. Use it as your dedup key when loading into the SIEM.
  • Filter by module, one at a time. The module_name query parameter takes a single canonical module key such as CompromisedComputers or FakeMobileApps. Omit it to receive alerts from every module you are subscribed to; to poll a specific subset, issue one request per module. See the Identifiers cheat sheet for how these keys relate to the display names inside the payload.
  • Treat per-module fields as optional. Field availability varies by module. source_name and source_group appear on some modules; Fake URLs and Phishing events carry suspect_url instead.

First-time setup​

Backfill before you start polling live. Run the historic endpoints with last_n_days up to 30 to load existing alerts, then switch to polling the live feed for anything new:

curl -s "https://api.cloudsek.com/v2/incidents/historic/alerts?last_n_days=30&limit=50&page=1" \
  -H "Authorization: Bearer $TOKEN"

Next​

Once alerts flow into your SIEM, add the Changelog lifecycle sync so you also catch every status and assignment change after the alert first arrives.