Set a detection alert status

Auth

Set the status of one or more detection alerts.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

An object containing desired status and explicit alert ids or a query to select alerts

One of:

signal_ids string[] · format: nonempty · min items: 1 required: List of alert ids. Use field _id on alert document or kibana.alert.uuid. Note: signals are a deprecated term for alerts.
status enum required: Values: open closed acknowledged in-progress

conflicts enum · default: abort: Values: abort proceed
query object required
runtime_fields map string to enum · max properties: 100: Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from _source[fieldName] and included in the query as runtime_mappings. Use this to reference fields stored on the alert _source that are not part of the alerts index mapping, for example, custom fields added via data view runtime fields. The combined number of unique field names across runtime_fields and runtime_mappings must not exceed 100.
runtime_mappings map string to object · max properties: 100: Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script. The combined number of unique field names across runtime_fields and runtime_mappings must not exceed 100.
status enum required: Values: open closed acknowledged in-progress

Successful response

application/json

Response Type: object

Invalid input data response

application/json

One of:

Unsuccessful authentication response

application/json

Internal server error response

application/json