What this endpoint does

Lists and searches the classic alert rules configured in your organization. Alert rules define the conditions that trigger alerts — each rule is linked to intelligence goals and use cases that determine what threat intelligence events generate notifications. Use the freetext parameter to filter rules by title. Rule IDs returned here appear in alert objects from the Alerts: Search endpoint, connecting each triggered alert back to the rule that produced it.

Response data

Returns a paginated list of alert rule objects, each containing the rule's ID, title, priority flag, enabled/disabled state, creation date, and owning organization. Rules also include their linked intelligence goals, use case ID, tags, and notification settings (email and mobile subscriber lists). The counts object provides returned and total values for pagination.