Set attack discovery alerts workflow status

Base URL: https://{kibana_url}

POST /api/detection_engine/attacks/status
POST /s/{space_id}/api/detection_engine/attacks/status

Auth

Set the workflow status of one or more attack discovery alerts by IDs, optionally cascading the status to their related detection alerts.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

An object containing the desired status and explicit attack ids

One of:

status: closed

status enum required: Values: closed
ids string[] · format: nonempty · min items: 1 required: A list of alerts ids.
reason union oneOf: The reason for closing the alerts. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user through the advanced settings.; Values: false_positive duplicate true_positive benign_positive automated_closure other
update_related_alerts boolean · default: false: When true, the change is also applied to detection alerts related to the attacks via kibana.alert.attack_discovery.alert_ids.

Responses

Successful response

application/json

Response Type: object

Invalid input data response

application/json

One of:

error string required
message string required
statusCode integer required

Unsuccessful authentication response

application/json

error string required
message string required
statusCode integer required

Internal server error response

application/json

message string required
status_code integer required

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/attacks/status
{
  "ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "status": "acknowledged"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/attacks/status" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "status": "acknowledged"
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 81,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "error": "Bad Request",
  "message": "[request body].ids: at least one attack id is required to update status",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/attacks/status
{
  "ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "reason": "false_positive",
  "status": "closed"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/attacks/status" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "reason": "false_positive",
    "status": "closed"
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 81,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "error": "Bad Request",
  "message": "[request body].ids: at least one attack id is required to update status",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/attacks/status
{
  "ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "status": "closed",
  "update_related_alerts": true
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/attacks/status" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "status": "closed",
    "update_related_alerts": true
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 81,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "error": "Bad Request",
  "message": "[request body].ids: at least one attack id is required to update status",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}