---
title: stack kb security-detections-api set-alerts-status cli command
description: Set a detection alert status Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4097/reference/elastic-cli/cli/stack/kb/security-detections-api/set-alerts-status
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb security-detections-api set-alerts-status cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb security-detections-api set-alerts-status \
  --status <status> \
  [options]
```

Set a detection alert status
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--status enum required">
    **Values:** open, acknowledged, in-progress
  </definition>
  <definition term="--reason string">
  </definition>
  <definition term="--signal-ids string[]">
    List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.
    **Repeatable:** pass `--signal-ids` multiple times to supply more than one value
  </definition>
  <definition term="--conflicts enum">
    **Values:** abort, proceed
  </definition>
  <definition term="--query string">
  </definition>
  <definition term="--runtime-fields string">
    Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>