Skip to main content
Panther Knowledge Base

How do I find all alerts in Panther for a particular alert ID or log type?


How do I find all alerts for a particular alert ID and/or log type?


 There are two ways:


Option 1: You can run the following query via the Data Explorer in the Panther Console:

select distinct(p_alert_id) from panther_views.public.all_rule_matches
where p_log_type = 'MY LOG TYPE' 

Make sure you have DISTINCT followed after the SELECT statement if you want alerts and not all the contributing events of the alerts that are not filtered out by deduplication.


Option 2: You can run an API query. 

If you want to test out your query before running a script, be sure to take advantage of Panther's API playground and run a query similar to the following template:

query ListAlerts {
      alerts(input: {logTypes: "YOURLOGTYPE", createdAtBefore: "2022-01-01T00:00:00.000Z", createdAtAfter: "2022-01-01T00:00:00.000Z"}) {
        edges {
          node {
        pageInfo {

Be sure to substitute your own time range and log type for the placeholder!