How do I query the alerts that matched a Panther rule in the API?

QUESTION

 How do I query the alerts that matched a rule in Panther? For example, I want to query the alerts from the Okta API Key Created rule.

ANSWER

This can be achieved using Panther's API — both GraphQL and REST API. You can locate the rule's ID, then set that as the value for detectionId in your query.

Here's an example of the GraphQL query:

query ListAlertsByRule {
  alerts(input:{
		pageSize: 50,
    detectionId: "Okta.APIKeyCreated"
  }) {
    edges {
      node {
        id
        title
        createdAt
        severity
		status
		runbook
		reference
      }
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}