stack kb security-detections-api set-alerts-status cli command

elastic stack kb security-detections-api set-alerts-status \
  --status <status> \
  [options]
		

Set a detection alert status

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--status enum required

Values: open, acknowledged, in-progress

--reason string

--signal-ids string[]

List of alert ids. Use field _id on alert document or kibana.alert.uuid. Note: signals are a deprecated term for alerts.

Repeatable: pass --signal-ids multiple times to supply more than one value

--conflicts enum

Values: abort, proceed

--query string

--runtime-fields string

Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from _source[fieldName] and included in the query as runtime_mappings. Use this to reference fields stored on the alert _source that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--json

output as JSON