Set a detection alert status
https://{kibana_url}
- POST /api/detection_engine/signals/status
- POST /s/{space_id}/api/detection_engine/signals/status
Refer to Spaces for more information.
Set the status of one or more detection alerts.
Request
An object containing desired status and explicit alert ids or a query to select alerts
One of:-
signal_idsstring · min: 1required -
List of alert ids. Use field
_idon alert document orkibana.alert.uuid. Note: signals are a deprecated term for alerts. -
status -
Values:
openclosedacknowledgedin-progress
-
conflicts· default: abort -
Values:
abortproceed -
queryobjectrequired -
runtime_fieldsmap string to object -
Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from
_source[fieldName]and included in the query asruntime_mappings. Use this to reference fields stored on the alert_sourcethat are not part of the alerts index mapping, for example, custom fields added via data view runtime fields. The combined number of unique field names acrossruntime_fieldsandruntime_mappingsmust not exceed 100. -
runtime_mappingsmap string to object -
Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script. The combined number of unique field names across
runtime_fieldsandruntime_mappingsmust not exceed 100. -
<string> -
formatstring · max: 100 -
Format string for date runtime fields, for example
strict_date_optional_time. -
scriptobject -
Inline Painless script that Elasticsearch evaluates for each alert. Only
sourceis accepted. Stored scripts, parameterized scripts (params), and non-defaultlangvalues are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics. -
sourcestring · max: 10000required -
Painless script source to execute.
-
type -
The data type for the runtime field type. Determines how the field value is indexed and queried.
-
Values:
keywordlongdoubledateipbooleangeo_point -
status -
Values:
openclosedacknowledgedin-progress
Responses
Successful response
Response Type: object
Invalid input data response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
-
messagestringrequired -
status_codeintegerrequired
Unsuccessful authentication response
-
errorstringrequired -
messagestringrequired -
statusCodeintegerrequired
Internal server error response
-
messagestringrequired -
status_codeintegerrequired