Supported query filter fields

See Query filters for reference on filter syntax, and review the filter examples below.

Fields supported by alerts.list

Filter fields
alertId	Should be used to filter alerts based on alert id. Corresponding value should be of type: string .
type	Should be used to filter alerts based on alert type. Corresponding value should be of type: string . Possible values for this filter are listed in the Alert.type field description .
source	Should be used to filter alerts based on alert source. Corresponding value should be of type: string . Possible values for this filter are listed in the Alert.type field description .
createTime	Should be used to filter alerts based on alert creation time. Corresponding value should be of type: string ( Timestamp format) ; more specifically, an RFC 3339 date-time string, for example, "2018-01-01T00:00:00Z"
startTime	Should be used to filter alerts based on alert start time. Corresponding value should be of type: string ( Timestamp format) ; more specifically, an RFC 3339 date-time string, for example, "2018-01-01T00:00:00Z"
endTime	Should be used to filter alerts based on alert end time. Corresponding value should be of type: string ( Timestamp format) ; more specifically, an RFC 3339 date-time string, for example, "2018-01-01T00:00:00Z"

List query examples

• To query for all alerts created on or after April 5, 2018:
  createTime >= "2018-04-05T00:00:00Z"
• To query for all alerts from the source "Gmail phishing":
  source:"Gmail phishing"
• To query for all alerts that started in 2017:
  startTime >= "2017-01-01T00:00:00Z&" AND startTime < "2018-01-01T00:00:00Z"
• To query for all user-reported phishing alerts from the source "Gmail phishing":
  type:"User reported phishing" source:"Gmail phishing"

Fields supported by alerts.feedback.list

Filter fields
alertId	Should be used to filter alert feedback based on alert id. Corresponding value should be of type: string . Can be used to list feedback for selected alerts in one call when the '-' wildcard is used in request's alertId .
feedbackId	Should be used to filter alert feedback based on feedback id. Corresponding value should be of type: string .

Feedback list query examples

• To query feedback of alerts with ids alertId01 or alertId02 :
  alertId = alertId01 OR alertId = alertId02
• To query feedback of an alert alertId01 with feedback id feedbackId01 :
  alertId = alertId01 AND feedbackId = feedbackId01