Bulk update Attack discoveries
- Base URL
-
https://{kibana_url}
- POST /api/attack_discovery/_bulk
- POST /s/{space_id}/api/attack_discovery/_bulk
Refer to Spaces for more information.
Performs bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings. This endpoint allows efficient batch processing of alert modifications without requiring individual API calls for each alert.
Request body
Bulk update parameters for Attack discoveries
-
updateobjectrequired -
Configuration object containing all parameters for the bulk update operation
-
enable_field_renderingboolean · default: false -
Enables a markdown syntax used to render pivot fields, for example
{{ user.name james }}. When disabled, the same example would be rendered asjames. This is primarily used for Attack Discovery views within Kibana. Defaults tofalse. -
kibana_alert_workflow_status -
When provided, update the kibana.alert.workflow_status of the attack discovery alerts
-
Values:
openacknowledgedclosed
Responses
Indicates a successful call.
-
dataobjectrequired -
Array of updated Attack Discovery alert objects. Each item includes the applied modifications from the bulk update request.
-
alert_rule_uuidstring -
The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)
-
alert_updated_by_user_idstring -
The optional id of the user who last updated the attack discovery alert
-
alert_updated_by_user_namestring -
The optional username of the user who updated the attack discovery alert
-
alert_workflow_reasonstring -
The optional kibana.alert.workflow_reason of this attack discovery, which records why the workflow status was last changed
-
alert_workflow_status_updated_atstring -
The optional time the attack discovery alert workflow status was last updated
-
connector_namestringrequired -
The (human readable) name of the connector that generated the attack discovery
-
details_markdownstringrequired -
Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.
-
entity_summary_markdownstring -
An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax
-
The optional array of tags assigned the attack
-
timestampstring · format: nonempty · min length: 1required -
A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.