Add and remove attack discovery alert tags

Base URL: https://{kibana_url}

POST /api/detection_engine/attacks/tags
POST /s/{space_id}/api/detection_engine/attacks/tags

Auth

Add tags to attack discovery alerts, and remove them from alerts, by attack IDs in a single request. Optionally cascade tag changes to related detection alerts.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

An object containing tags to add or remove and attack ids the changes will be applied to

ids string[] · format: nonempty · min items: 1 required: A list of alerts ids.
tags object required: Object with list of tags to add and remove.
update_related_alerts boolean · default: false: When true, the change is also applied to detection alerts related to the attacks via kibana.alert.attack_discovery.alert_ids.

Responses

Successful response

application/json

Response Type: object

Invalid input data response

application/json

Unsuccessful authentication response

application/json

Internal server error response

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/attacks/tags
{
  "ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "tags": {
    "tags_to_add": [
      "investigation"
    ],
    "tags_to_remove": []
  }
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/attacks/tags" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "tags": {
      "tags_to_add": [
        "investigation"
      ],
      "tags_to_remove": []
    }
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 68,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "message": [
    "Duplicate tags [\u0022duplicate\u0022] were found in the tags_to_add and tags_to_remove parameters."
  ],
  "status_code": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/attacks/tags
{
  "ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "tags": {
    "tags_to_add": [],
    "tags_to_remove": [
      "investigation"
    ]
  }
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/attacks/tags" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "tags": {
      "tags_to_add": [],
      "tags_to_remove": [
        "investigation"
      ]
    }
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 68,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "message": [
    "Duplicate tags [\u0022duplicate\u0022] were found in the tags_to_add and tags_to_remove parameters."
  ],
  "status_code": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/attacks/tags
{
  "ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "tags": {
    "tags_to_add": [
      "investigation"
    ],
    "tags_to_remove": []
  },
  "update_related_alerts": true
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/attacks/tags" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "tags": {
      "tags_to_add": [
        "investigation"
      ],
      "tags_to_remove": []
    },
    "update_related_alerts": true
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 68,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "message": [
    "Duplicate tags [\u0022duplicate\u0022] were found in the tags_to_add and tags_to_remove parameters."
  ],
  "status_code": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}