Carbon Black Cloud: Alert by ID API call fails to fetch events

[#1]

Environment

• Carbon Black Cloud Console: All versions
  • Endpoint Standard 
• Endpoint Standard REST API: Version 3
  • Alerts API

Symptoms

• The API call to /integrationServices/v3/alert/<alert_id> fails to return the events that triggered that alert
• The Events field on the alert object is an empty array
• Results example (deviceinfo and threatinfo have been scrubbed in this example. Notice there is no data next to the Events filed):

{
    "orgId": 1234,
    "deviceInfo": {
        ...
    },
    "threatInfo": {
        ...
    },
    "events": [],
    "success": true,
    "message": "Success"
}

Cause

Issue currently under investigation

Resolution

Carbon Black is currently investigating the root cause and fix for this issue

Related Content

https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-How-to-Troubleshoot-Connector-or-API-...
https://developer.carbonblack.com/reference/carbon-black-cloud/cb-defense/deprecated/rest-api/#alert...