.svg?fit=max&auto=format&n=cJUhKEokp8h2t8Ke&q=85&s=2192fe0b4406e259cba34cdda8acffdc)
Metrics
These endpoints summarize what your monitoring is catching — by source, by day, and over the year — so you can chart exposure and spot spikes. **Two different things get counted.** The overview and monthly trend count **result items** — the individual leaked records found. Alert-hit statistics count **matches** — how many times a rule fired. A single match can carry many result items, so the two won’t line up; pick the one that answers your question. Three of the four take aperiod, one of last_week, last_month, last_6_months, last_year, or all_time. All are org-scoped.
Overview — by source and day
alert_system_statistic_get_alert_overview gives one row per service per day:
period is required; narrow to specific sources with service_ids (comma-separated); paginated. Each row is { service_name, date, count, excluded_count } — count is result items found that day for that source, excluded_count how many of them an exclusion suppressed.
Monthly distribution — the year at a glance
alert_system_statistic_get_monthly_match_count returns a plain list of the last 12 months — no period, no pagination:
{ month, count, excluded_count }, with month as YYYY-MM. Months with nothing return count: 0, so you always get 12 points to plot.
Alert-hit statistics — how often rules fire
alert_system_alert_get_alert_match_statistics counts matches per source per day:
period is required; filter sources with services (comma-separated — note the param is services here, not service_ids); add show_excluded=true to include all-excluded matches; paginated. Each row is { alert_hit_count, creation_date, service_id, service_name }.
Your organization’s default cadence
New rules created without afrequency inherit your org default. Read it with alert_system_setting_get_organization_alert_frequency and change it with alert_system_setting_update_organization_alert_frequency:
default_alert_frequency takes the same six values as a rule’s frequency (daily, twice_weekly, weekly, biweekly, twice_monthly, monthly) and defaults to daily. It’s a floor for convenience, not an override: a rule still can’t run faster than its source allows, so the effective cadence is the slower of this default and the source’s own.