Set a detection alert status

POST /api/detection_engine/signals/status
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/detection_engine/signals/status

Refer to Spaces for more information.

Set the status of one or more detection alerts.

application/json
Body object Required

An object containing desired status and explicit alert ids or a query to select alerts

One of:
Security_Detections_API_SetAlertsStatusByIds object Security_Detections_API_SetAlertsStatusByQuery object

Responses

  • 200 application/json

    Successful response

    Elasticsearch update by query response

    Additional properties are allowed.
  • 400 application/json

    Invalid input data response

    One of:
    Security_Detections_API_PlatformErrorResponse object Security_Detections_API_SiemErrorResponse object
  • 401 application/json

    Unsuccessful authentication response

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode integer Required
  • 500 application/json

    Internal server error response

    Hide response attributes Show response attributes object
    • message string Required
    • status_code integer Required
POST /api/detection_engine/signals/status 
curl \
 --request POST 'https://localhost:5601/api/detection_engine/signals/status' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{
  "signal_ids": [
    "string"
  ],
  "status": "open"
}'