Query recent alerts emitted by a specific detection bot

What information can I get?

This query will return specified detection bots’ alerts that were created since 10 minutes ago. This query can be useful if you’d like to take immediate action such as the following after receiving the alerts:

Some example use cases:

• As a dApp owner, warn or notify my users of potential threats and governance changes in the dApp.
• As a developer, automate mitigation steps after receiving a combination of alerts from 2 or more detection bots.

How to execute this query?

Step 1: Go to Forta API Sandbox. Make sure the endpoint is set to https://api.forta.network/graphql in the top left corner before proceeding to the next steps.

Step 2: Create a new workspace.

Step 3: Paste the following query in the Operation panel. For more details on the available alert fields, please checkout the AlertsResponse Schema.

query recentAlerts($input: AlertsInput) {
  alerts(input: $input) {
    pageInfo {
      hasNextPage
      endCursor {
        alertId
        blockNumber
      }
    }
    alerts {
      createdAt
      name
      protocol
      findingType
      source {
        transactionHash
        block {
          number
          chainId
        }
        bot {
          id
        }
      }
      severity
      metadata
      scanNodeCount
    }
  }
}

Step 4: Replace the placeholders in the following query parameters and paste them in the Variable panel. For more details on the available query parameters, please checkout the AlertsInput Schema

{
  "input": {
    "first": 5,
    "bots": [<BOT_ID_A>, <BOT_ID_B>],
    "createdSince": 600000,
    "chainId": 1
  }
}

Step 5: Click on the blue submit button on the Operation panel to execute the query.

The button will look like the following:

NOTE: The button text will be different depending on the query name.

And that’s it! You should be able to see the query results in the Response panel on the right.

The results are paginated, how do I get the next page?

If the output returns "hasNextPage": true, add the after query parameter in the input object to get the next page of alerts and execute the query.

{
  "input": {
    ...
    "after": {
      "blockNumber": "<END_CURSOR_BLOCK_NUMBER>",
      "alertId": "<END_CURSOR_ALERT_ID>"
    }
  }
}

Additional Filters

Filter alerts by number of scan node confirmations

The following input filter will return alerts with scanNodeCount ranging from 2 to 10 (inclusive). You don’t need to define both gte and lte at the same time.

{
  "input": {
    ...
    // scanNodeCount is the number of scan nodes that found the alert
    "scanNodeConfirmations": {
      "gte": 2,
      "lte": 10
    }
  }
}

If you’re only interested in alerts with a scanNodeCount of 3, make sure the gte and lte value matches.

{
  "input": {
    ...
    "scanNodeConfirmations": {
      "gte": 3,
      "lte": 3
    }
  }
}