Set a detection alert status

POST /api/detection_engine/signals/status

Set the status of one or more detection alerts.

application/json; Elastic-Api-Version=2023-10-31

An object containing desired status and explicit alert ids or a query to select alerts

signal_ids array[string] Required

A string that is not empty and does not contain only whitespace

At least 1 element. Minimum length of each is 1. Format of each should match the following pattern: ^(?! *$).+$.
status string Required

Values are open, closed, acknowledged, or in-progress.

conflicts string

Values are abort or proceed. Default value is abort.
query object Required
Hide query attribute Show query attribute object
- Additional properties are allowed
status string Required

Values are open, closed, acknowledged, or in-progress.

POST /api/detection_engine/signals/status

curl \
 -X POST http://api.example.com/api/detection_engine/signals/status \
 -H "Content-Type: application/json; Elastic-Api-Version=2023-10-31"

Request examples

{
  "signal_ids": [
    "string"
  ],
  "status": "open"
}

{
  "conflicts": "abort",
  "query": {},
  "status": "open"
}

Response examples (200)

{}

Response examples (400)

{
  "error": "string",
  "message": "string",
  "statusCode": 42
}

{
  "message": "string",
  "status_code": 42
}

Response examples (401)

{
  "error": "string",
  "message": "string",
  "statusCode": 42
}

Response examples (500)

{
  "message": "string",
  "status_code": 42
}