How can I get a list of all Panther detections that triggered an alert to Slackbot within a specific timeframe?
QUESTION
How can I get a list of all detections that triggered an alert to the Slackbot within a specific timeframe?
ANSWER
To do this:
- Track Slack
outputIds
along withOK
Status Codes for every alert based on your filters. - Review the delivery of each alert's Alert Destination and compare the Status Code with the
outputId
of their known Slack Destinations.- For example, you have SlackDestA, SlackDestB, and SlackDestC. For every alert, you will need to examine the following:
deliveries {dispatchedAt, statusCode, outputId}
- For example, you have SlackDestA, SlackDestB, and SlackDestC. For every alert, you will need to examine the following:
- Copy the
destinationID
from the Alert Destinations page for your Slack destination(s).
- By using a
ListAlerts
query similar to the example below, thedestinationID
will be matched with theoutputId
if the alert was sent to that destination, specifically Slack.
- By using a
- An alert will be successfully sent to the destination if the
statusCode
is within the range of 200 and 299 (2XX).- In
outputId
, we are specifically looking for theoutputId
of SlackDest A, B, and C, and then verifying if it has a successful status code.
- In
List alerts example from Step 3:
query ListAlerts {
alerts(
input: {
pageSize: 50,
severities: [INFO, LOW, MEDIUM, HIGH, CRITICAL],
createdAtAfter: "2023-09-13T17:45:00.000Z",
createdAtBefore: "2023-09-18T17:45:00.000Z"
}
) {
edges {
node {
id
title
deliveries {
dispatchedAt
statusCode
outputId
}
}
}
pageInfo {
hasNextPage
endCursor
}
}
}