The Alert datatype for the configuration of an alert.

Table: Alert

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For some fields, this column indicates that a result will always be returned for this column.
Table last updated: Oct 29, 2025
actionsstringyes Long-TermList of identifiers for actions to fire on query result.
actionsV2[Action]yes Long-TermList of unique identifiers for actions to fire on query result. See Action.
allowedActions[AssetAction]yes Short-TermList of allowed actions. See AssetAction .
createdInfoAssetCommitMetadata  Long-TermMetadata related to the creation of the alert. See AssetCommitMetadata.
descriptionstring  Long-TermDescription of alert.
displayNamestringyes Long-TermName of the alert.
enabledbooleanyes Long-TermFlag indicating whether the alert is enabled.
idstringyes Long-TermThe identifier of the alert.
labels[string]yes Long-TermLabels attached to the alert.
lastErrorstring  Long-TermLast error encountered while running the alert.
lastWarnings[string]yes Long-TermLast warnings encountered while running the alert.
namestringyes Long-TermThe name of the alert.
packagePackageInstallation  Long-TermA package installation. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-TermThe unique identifier of the package installed, if one was used. VersionedPackageSpecifier is a scalar.
queryOwnershipQueryOwnershipyes Long-TermOwnership of the query run by the alert. See QueryOwnership.
queryStartstringyes Long-TermStart of the relative time interval for the query.
queryStringstringyes Long-TermLogScale query to execute.
resourcestringyes Short-TermThe resource identifier for the alert.
runAsUserUser  Long-TermIdentifier of user by which the alert is run. See User.
throttleFieldstring  Long-TermField on which to throttle alert.
throttleTimeMillislongyes Long-TermThrottle time in milliseconds.
timeOfLastTriggerlong  Long-TermUNIX timestamp for when the alert was last triggered.
yamlTemplatestringyes Long-TermThe yaml formatted text that describes the alert. YAML is a scalar.