List Devices Affected By An Alert

This action returns similar data to the action, except that only affected devices are returned. There is also an additional device field indicating if the alert is resolved for the device.

To learn more, visit the Claroty xDome documentation.

Parameters​

Parameter	Description
Alert ID	Alert ID, as indicated in the id field of an alert.
Fields	Specify which fields to return for each item.

Example Output​

{  "devices": [    {      "asset_id": "xxxxxxx",      "risk_score": "xxxxx",      "os_category": "xxxx",      "labels": [],      "device_type_family": "xxxxxxx",      "vlan_list": [x],      "mac_list": ["xxxxxxxxxxxx"],      "device_subcategory": "xxxxxxxxxxxxxx",      "retired": xxxx,      "assignees": [],      "uid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",      "network_list": ["xxxxxxxxx"],      "model": "xxxxxxxxxxxxxxx",      "device_type": "xxxxxxxx",      "device_category": "xxx",      "ip_list": ["xxx.xxx.xxx.xxx"],      "is_resolved": xxxx    }  ]}

Workflow Library Example​

List Devices Affected by an Alert with Claroty Xdome and Send Results Via Email

Preview this Workflow on desktop