Skip to main content
ZStack
Alerting & Response/Alert Events

GetAlertStormSummary

Retrieve summary details for a specific alert storm group

GET/api/v1/alerting/storms/{groupId}

Operation ID

GetAlertStormSummary

Since

1.0.0

Execution Mode

Synchronous

Auth Context

Auth Required

Auth Context

Send these values as request headers when calling this API.

AuthorizationstringRequired

Bearer Token

X-Tenant-IDstring

X-Tenant-ID

Request Inputs

Path Parameters

  • groupId
    StringRequired

    Group identifier for the storm to retrieve

Responses

200 OK
200 OK

On success, this API returns the following response structure.

  • groupId
    String

    Unique group identifier for the storm

    Example: storm-group-001

  • groupKey
    String

    Grouping key used to correlate alerts

    Example: host=db-01,severity=critical

  • firstSeen
    String

    Timestamp when the first alert in this storm occurred

    Example: 2026-01-15T08:00:00Z

  • lastSeen
    String

    Timestamp of the most recent alert in this storm

    Example: 2026-01-15T08:00:00Z

  • alertCount
    Integer

    Total number of alerts in this storm group

    Example: 47

  • sampleAlerts
    List

    Sample of representative alerts from this storm

    Example: (nested array)

    • uuid
      String

      Unique identifier of the alert instance

      Example: alert-789xyz

    • ruleUuid
      String

      UUID of the rule that generated this alert

      Example: rule-abc123-def456

    • ruleName
      String

      Name of the rule that generated this alert

      Example: High CPU Usage

    • resourceType
      String

      Type of monitored resource

      Example: vm

    • resourceUuid
      String

      UUID of the specific resource that triggered

      Example: res-abc123

    • metricName
      String

      Metric name that was evaluated

      Example: cpu_usage_percent

    • currentValue
      Long

      Current metric value at the time of alert

      Example: 95.3

    • threshold
      Long

      Threshold that was exceeded

      Example: 90

    • operator
      String

      Comparison operator used for evaluation

      Example: >

    • severity
      String

      Severity level of this alert

      Example: critical

    • state
      String

      Current state of the alert (firing, resolved, acknowledged)

      Example: firing

    • message
      String

      Human-readable alert message

      Example: CPU usage is 95.3%, exceeding threshold of 90%

    • fingerprint
      String

      Unique fingerprint for alert deduplication

      Example: fp-abc123def456

    • source
      String

      Source system that generated the alert

      Example: prometheus

    • notifiedAt
      String

      Timestamp when the notification was sent

      Example: 2026-01-15T08:00:00Z

    • resolvedAt
      String

      Timestamp when the alert was resolved

      Example: 2026-01-15T08:00:00Z

    • acknowledgedBy
      String

      User who acknowledged this alert

      Example: admin

    • acknowledgedAt
      String

      Timestamp when the alert was acknowledged

      Example: 2026-01-15T08:00:00Z

    • createDate
      String

      Timestamp when the alert was created

      Example: 2026-01-15T08:00:00Z

  • affectedHosts
    List

    List of hosts affected by this storm

    Example: item1,item2

  • state
    String

    Current state of the storm (active, resolved)

    Example: active

  • notifiedAt
    String

    Timestamp when the storm notification was sent

    Example: 2026-01-15T08:00:00Z

  • labels
    LinkedHashMap

    Key-value labels attached to this resource

    Example: (nested object)