Skip to main content
With plerion alerts, you can view and filter risk-based alerts across your cloud environments with support for status, provider, alert type, and other filters.
For more about alerts in the Plerion dashboard, see Alerts overview.

​
Synopsis

plerion alerts list [options]

​
Subcommands

​
list

List risk-based alerts with filtering and sorting. 
plerion alerts list [options]

​
Options

FlagTypeDescription
--statusstringOPEN or RESOLVED
--providerstringCloud provider: AWS, Azure, GCP, Kubernetes (case-insensitive)
--alert-typestringASSET or FINDING
--flaggedbooleanFilter by flagged status (true or false)
--acknowledgedbooleanFilter by acknowledged status (true or false)
--sort-bystringriskScore or discoveredDate
--sort-orderstringasc or desc
--idsstringFilter by alert IDs (comma-separated)
--workflow-idstringFilter by workflow IDs (comma-separated)
--asset-group-idstringFilter by asset group IDs (comma-separated)
--resource-typestringFilter by resource types (comma-separated)
--integration-idstringFilter by integration IDs (comma-separated)
--per-pagenumberResults per page (default: 50, max: 1000)
--allflagFetch all pages automatically

​
Examples

# Open alerts sorted by risk score (highest first)
plerion alerts list --status OPEN --sort-by riskScore --sort-order desc

# Flagged alerts only
plerion alerts list --flagged true

# Asset-type alerts
plerion alerts list --alert-type ASSET --output table

# All AWS alerts as JSON
plerion alerts list --provider AWS --output json

# Fetch all alerts across all pages
plerion alerts list --all --output json

​
Output columns

Table output includes all fields returned by the API:
ColumnDescription
IDAlert ID
TITLEAlert title
STATUSOPEN or RESOLVED
TYPEASSET or FINDING
RISK SCORENumeric risk score
FLAGGEDWhether flagged
ACKNOWLEDGEDWhether acknowledged
TENANT IDTenant ID
INTEGRATION IDIntegration ID
WORKFLOW IDAssociated workflow ID
PROVIDERCloud provider
SERVICECloud service
REGIONCloud region
RESOURCE IDResource identifier
RESOURCE TYPEResource type
RESOURCE NAMEResource name
ACCOUNT IDCloud account ID
FIRST OBSERVEDFirst observed timestamp
DISCOVEREDAlert discovery timestamp
LAST SCANNEDLast scan timestamp
RULES CHANGEDRules last changed timestamp
CLOSED ATClosed timestamp
CREATED ATRecord creation timestamp
UPDATED ATRecord update timestamp