--- title: Alert Logic slug: connectors/alert-logic docTags: createdAt: 2026-06-09T16:30:23.466Z --- Alert Logic MDR provides single pane-of-glass visibility across public cloud, hybrid, and on-premises environments, providing vital insights on your security posture, and detecting and responding to threats to your business. ## Prerequisites To authenticate this connector, you need one of the following: - Username and Password - Access Key ID and Secret Key ## Capabilities This connector provides the following capabilities: - Add Incident Feedback - Close Incident - Get Incident History - Get Incident ID by Friendly ID - Get Incident - Get Incident by Time - Get Logs/Events for Incident - Reopen Incident ## Notes - [Alert Logic IRIS API Documentation](https://console.cloudinsight.alertlogic.com/api/iris) - [Alert Logic API Authentication](https://console.cloudinsight.alertlogic.com/api/aims) ## Additional Documentation - [Alert Logic Connector Documentation](https://docs.swimlane.com/connectors/alert-logic) - [Alert Logic API Documentation](https://console.cloudinsight.alertlogic.com/api/iris) # Configurations ## Alert Logic Authentication Authenticates using username/access\_key\_id and password/secret\_key. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username or Access Key ID | string | Required | | password | Password or Secret Key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Incident Feedback Update incident feedback for an incident. ### Endpoint - **URL:** `/iris/v3/{{accountId}}/{{incidentId}}/feedback` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.accountId` | string | Optional | Parameters for the Add Incident Feedback action | | `path_parameters.incidentId` | string | Required | Parameters for the Add Incident Feedback action | | `customer_feedback` | string | Optional | Parameter for Add Incident Feedback | | `customer_feedback_reason` | string | Optional | Reason for feedback. Allowed values: further\_action, acceptable\_risk, compensating\_control, threat\_not\_valid, not\_concluded, other | ### Input Example `{"json_body":{"customer_feedback":"My feedback","customer_feedback_reason":"further_action"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `feedback` | string | Output field: feedback | | `feedback_datetime` | string | Time value | | `feedback_reason` | string | Response reason phrase | | `feedback_uid` | string | Unique identifier | | `feedback_user` | string | Output field: feedback\_user | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"feedback":"My feedback","feedback_datetime":"2020-05-25T19:21:04.854130+00:00","feedback_reason":"further_action","feedback_uid":"FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF","feedback_user":"User Name "}}` ## Close Incident Close an incident. ### Endpoint - **URL:** `/iris/v3/{{accountId}}/{{incidentId}}/complete` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.accountId` | string | Optional | Parameters for the Close Incident action | | `path_parameters.incidentId` | string | Required | Parameters for the Close Incident action | | `notes` | string | Optional | Parameter for Close Incident | | `reason_code` | string | Optional | Reason for completion. Allowed values: further\_action, acceptable\_risk, compensating\_control, threat\_not\_valid, not\_concluded, other | ### Input Example `{"path_parameters":{"accountId":"string","incidentId":"string"},"notes":"string","reason_code":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `new` | object | Output field: new | | `new.notes` | string | Output field: new\.notes | | `new.reason_code` | string | Response reason phrase | | `new.status` | string | Status value | | `new.status_change_time` | string | Status value | | `old` | object | Output field: old | | `old.status` | string | Status value | | `old.status_change_time` | string | Status value | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"new":{"notes":"This incident is closed because of y","reason_code":"further_action","status":"completed","status_change_time":"2020-05-22T11:09:56.855569+00:00"},"old":{"status":"open","status_change_time":"2020-05-22T07:54:33.555371+00:00"}}}` ## Get Incident Fetch a specific incident by its incident ID. ### Endpoint - **URL:** `/iris/v3/{{accountId}}/{{incidentId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.accountId` | string | Optional | Parameters for the Get Incident action | | `path_parameters.incidentId` | string | Required | Parameters for the Get Incident action | | `parameters.return_value` | string | Optional | Comma delimited list of "dot-notation" string names of desired properties in the result set. Use if you only want a subset of attributes from the incident. | ### Input Example `{"path_parameters":{"accountId":"string","incidentId":"string"},"parameters":{"return_value":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}` ## Get Incident History Fetch history for an specific incident by its incident ID. ### Endpoint - **URL:** `/iris/v3/{{accountId}}/{{incidentId}}/history` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.accountId` | string | Optional | Parameters for the Get Incident History action | | `path_parameters.incidentId` | string | Required | Parameters for the Get Incident History action | ### Input Example `{"path_parameters":{"accountId":"string","incidentId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":[{"details":{},"historyType":2012,"message":"Incident Created","time":1527253566.384131,"time_str":"2018-05-25T13:06:06.384131+00:00","who":"System"}]}` ## Get Incident ID by Friendly ID Fetch a specific incident by its friendly ID. ### Endpoint - **URL:** `/iris/v3/{{accountId}}/friendly/{{friendlyId}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------------------------------- | | `path_parameters.accountId` | string | Optional | Parameters for the Get Incident ID by Friendly ID action | | `path_parameters.friendlyId` | string | Required | Parameters for the Get Incident ID by Friendly ID action | ### Input Example `{"path_parameters":{"accountId":"string","friendlyId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":[{"incidentId":"610DE0F9-0001-0020-0002-B58A00000000","humanFriendlyId":"aecbf","accountId":1234}]}` ## Get Incidents by Time Fetch incidents last updated within a time span for the specified account. ### Endpoint - **URL:** `/iris/v3/{{accountId}}/incidents_by_time` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.accountId` | string | Optional | Parameters for the Get Incidents by Time action | | `parameters.return_value` | string | Optional | Parameters for the Get Incidents by Time action | | `parameters.start_time` | string | Optional | Parameters for the Get Incidents by Time action | | `parameters.end_time` | string | Optional | Parameters for the Get Incidents by Time action | | `parameters.pagination` | boolean | Optional | Parameters for the Get Incidents by Time action | | `parameters.limit` | number | Optional | Parameters for the Get Incidents by Time action | | `parameters.offset` | number | Optional | Parameters for the Get Incidents by Time action | ### Input Example `{"parameters":{"return_value":"string","start_time":"string","end_time":"string","pagination":false,"limit":10,"offset":5},"path_parameters":{"accountId":"1234"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}` ## Get Logs/Events for Incident Get associated logs/events for a incident. ### Endpoint - **URL:** `/iris/v3/{{accountId}}/{{incidentId}}/elaborations/associated` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.accountId` | string | Optional | Parameters for the Get Logs/Events for Incident action | | `path_parameters.incidentId` | string | Required | Parameters for the Get Logs/Events for Incident action | | `parameters.returnSource` | string | Optional | Parameters for the Get Logs/Events for Incident action | | `parameters.return_value` | string | Optional | Comma delimited list of "dot-notation" string names of desired properties in the result set. Use if you only want a subset of attributes from the incident. | | `parameters.limit` | number | Optional | Maximum number of items in the result set. | | `parameters.offset` | number | Optional | The (zero-based) offset of the first item in the result set to return. | ### Input Example `{"path_parameters":{"accountId":"string","incidentId":"string"},"parameters":{"returnSource":"string","return_value":"string","limit":123,"offset":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}` ## Reopen Incident Reopen an incident. ### Endpoint - **URL:** `/iris/v3/{{accountId}}/{{incidentId}}/reopen` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ----------------------------------------- | | `path_parameters.accountId` | string | Optional | Parameters for the Reopen Incident action | | `path_parameters.incidentId` | string | Required | Parameters for the Reopen Incident action | | `notes` | string | Optional | Parameter for Reopen Incident | ### Input Example `{"path_parameters":{"accountId":"string","incidentId":"string"},"notes":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `new` | object | Output field: new | | `new.notes` | string | Output field: new\.notes | | `new.reason_code` | string | Response reason phrase | | `new.status` | string | Status value | | `new.status_change_time` | string | Status value | | `old` | object | Output field: old | | `old.status` | string | Status value | | `old.status_change_time` | string | Status value | | `old.reason_code` | string | Response reason phrase | | `old.notes` | string | Output field: old.notes | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"new":{"notes":"Reopened because of y","reason_code":"other","status":"open","status_change_time":"2020-05-22T11:09:56.855569+00:00"},"old":{"status":"completed","status_change_time":"2020-05-22T07:54:33.555371+00:00","reason_code":"further_action","notes":"closed because of x"}}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |