What this endpoint does

Lists and searches the classic alert rules configured in your organization. Rules define the intelligence conditions that trigger alerts — each rule specifies monitored entities, thresholds, and notification settings. Use this endpoint to discover rule IDs, then pass those IDs as the alertRule filter in Alerts: Search to retrieve alerts triggered by a specific rule. Use the freetext parameter to search rules by title, and limit to control result count. Note: this endpoint uses the v2 path (/alert/v2/rule), not v3 like other alerts endpoints.

Response data

Returns your organization's alert rule definitions with their current enabled/disabled state, priority flag, associated intelligence goals, and notification subscriber lists — enough to audit which rules are active and who gets notified. Use the rule id values to filter alert searches or to understand which detection logic produced a given alert.