Retrieve saved alert rules
| Field | Type | Description |
|---|---|---|
id | string | Rule identifier |
enabled | boolean | Whether the rule is active |
severity_threshold | string[] | Severities that trigger the rule |
asset_ids | string[] | Asset filter, or omitted for all assets |
threat_types | string[] | Threat-type filter |
max_distance_km | number | Optional asset proximity requirement |
mute_interval_hours | number | Suppression window |