Set a detection alert status
- Base URL
-
https://{kibana_url}
- POST /api/detection_engine/signals/status
- POST /s/{space_id}/api/detection_engine/signals/status
Set the status of one or more detection alerts.
- Base URL
-
https://{kibana_url}
https://{kibana_url}
Set the status of one or more detection alerts.
space_id
string
optional
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
An object containing desired status and explicit alert ids or a query to select alerts
One of:runtime_fields
map string to enum · max properties: 100
Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from _source[fieldName] and included in the query as runtime_mappings. Use this to reference fields stored on the alert _source that are not part of the alerts index mapping, for example, custom fields added via data view runtime fields. The combined number of unique field names across runtime_fields and runtime_mappings must not exceed 100.
<string>
enum
keyword
long
double
date
ip
boolean
geo_point
runtime_mappings
map string to object · max properties: 100
Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script. The combined number of unique field names across runtime_fields and runtime_mappings must not exceed 100.
Successful response
Response Type: object
Invalid input data response
Unsuccessful authentication response
https://{kibana_url}