Assign and unassign users from detection alerts

Server: https://{kibana_url}

POST /api/detection_engine/signals/assignees
POST /s/{space_id}/api/detection_engine/signals/assignees

Refer to Spaces for more information.

Assign users to detection alerts, and unassign them from alerts.

info You cannot add and remove the same assignee in the same request.

Request

Responses

Indicates a successful call. The body matches an Elasticsearch update-by-query response (for example took, updated, failures).

application/json

Invalid input data response

application/json

Unsuccessful authentication response

application/json

Not enough privileges response

application/json

Internal server error response

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/detection_engine/signals/assignees
{
  "assignees": {
    "add": [
      "u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0"
    ],
    "remove": []
  },
  "ids": [
    "681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6"
  ]
}

curl Shell

curl -X POST "https://{kibana_url}/api/detection_engine/signals/assignees" \
  -H "Content-Type: application/json" \
  -d '{
  "assignees": {
    "add": [
      "u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0"
    ],
    "remove": []
  },
  "ids": [
    "681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6"
  ]
}'

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 76,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "error": "Bad Request",
  "message": "[request body].ids: at least one alert id is required to update assignees",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "error": "Forbidden",
  "message": "API [POST /api/detection_engine/signals/assignees] is unauthorized for the current user, this action is granted by the Kibana Security Solution privileges for cases and detections",
  "statusCode": 403
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/detection_engine/signals/assignees
{
  "assignees": {
    "add": [],
    "remove": [
      "u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0"
    ]
  },
  "ids": [
    "681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6"
  ]
}

curl Shell

curl -X POST "https://{kibana_url}/api/detection_engine/signals/assignees" \
  -H "Content-Type: application/json" \
  -d '{
  "assignees": {
    "add": [],
    "remove": [
      "u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0"
    ]
  },
  "ids": [
    "681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6"
  ]
}'

Response

{
  "error": "Bad Request",
  "message": "[request body].ids: at least one alert id is required to update assignees",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "error": "Forbidden",
  "message": "API [POST /api/detection_engine/signals/assignees] is unauthorized for the current user, this action is granted by the Kibana Security Solution privileges for cases and detections",
  "statusCode": 403
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request { assignees , ids , }

Responses

Request