Assign and unassign users from detection alerts

POST /api/detection_engine/signals/assignees
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/detection_engine/signals/assignees

Refer to Spaces for more information.

Assign users to detection alerts, and unassign them from alerts.

You cannot add and remove the same assignee in the same request.

application/json

Body Required

  • assignees object Required

    Details about the assignees to assign and unassign.

    Hide assignees attributes Show assignees attributes object
    • add array[string(nonempty)] Required

      A list of user profile uids to assign. Users need to activate their user profile by logging into Kibana at least once.

      Minimum length of each is 1.

    • remove array[string(nonempty)] Required

      A list of user profile uids to unassign. Users need to activate their user profile by logging into Kibana at least once.

      Minimum length of each is 1.

  • ids array[string(nonempty)] Required

    List of alerts ids to assign and unassign passed assignees.

    At least 1 element. Minimum length of each is 1.

Responses

  • 200

    Indicates a successful call.

  • 400

    Invalid request.

POST /api/detection_engine/signals/assignees 
curl \
 --request POST 'https://localhost:5601/api/detection_engine/signals/assignees' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{
  "assignees": {
    "add": [
      "string"
    ],
    "remove": [
      "string"
    ]
  },
  "ids": [
    "string"
  ]
}'