Set attack discovery alerts workflow status

Base URL: https://{kibana_url}

POST /api/detection_engine/attacks/status
POST /s/{space_id}/api/detection_engine/attacks/status

Refer to Spaces for more information.

Set the workflow status of one or more attack discovery alerts by IDs, optionally cascading the status to their related detection alerts.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Request body

Responses

Successful response

application/json

Invalid input data response

application/json

Unsuccessful authentication response

application/json

Internal server error response

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/attacks/status
{
  "ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "status": "acknowledged"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/attacks/status" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "status": "acknowledged"
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 81,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "error": "Bad Request",
  "message": "[request body].ids: at least one attack id is required to update status",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/attacks/status
{
  "ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "reason": "false_positive",
  "status": "closed"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/attacks/status" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "reason": "false_positive",
    "status": "closed"
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 81,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "error": "Bad Request",
  "message": "[request body].ids: at least one attack id is required to update status",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/attacks/status
{
  "ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "status": "closed",
  "update_related_alerts": true
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/attacks/status" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "status": "closed",
    "update_related_alerts": true
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 81,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "error": "Bad Request",
  "message": "[request body].ids: at least one attack id is required to update status",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}