Alert Insights

The command lacework alert helps you perform initial discovery and analysis of alerts happening in your Lacework account.

You can quickly see the list of all the alerts from the last 7 days in your account with their severity:

lacework alert list

note

This command is limited to displaying 7 days of data.

To filter alerts by a time period:

To show all the alerts from a specific start time that has severity medium and above (critical, high, and medium):

Example start time of 26th August 2020 at 23:23:29

lacework alert list --start 2020-08-26T23:28:29Z --severity medium

note

Time constraint: The start time must be within the last 92 days. The difference between start and end time should not be greater than 7 days.

There are different types of alert details that can be shown to assist with alert investigation. These types are referred to as alert detail scopes.

The following alert detail scopes are available:

To drill into an alert and show its details with the default scope:

lacework alert show <alert_id>

View an alert's details with the timeline scope:

lacework alert show <alert_id> --scope Timeline

To open an alert in the Lacework Console for further investigation:

lacework alert open <alert_id>