Skip to main content
PUT
Update incident status

Path Parameters

workspaceId
string<uuid>
required
source
enum<string>
required
Available options:
Sentinel,
DefenderXDR,
QRadar,
Splunk,
CrowdStrike,
SentinelOne
incidentId
string
required

Body

application/json

v2 request body for updating an incident's status.

status
enum<string>
required

New status to apply to the incident.

Available options:
Active,
New,
Closed
comment
null | string

Optional comment recorded alongside the status change. Recommended when transitioning to Status.Closed.

classification
null | any

Required by Sentinel when closing an incident; ignored by sources that do not surface classifications.

Available options:
BenignPositive,
FalsePositive,
TruePositive,
Undetermined,
InformationalExpectedActivity,
Unknown,
NonIssue,
PolicyViolation,
QradarFalsePositive,
Undefined,
Suspicious,
null
classificationReason
null | any

Required by Sentinel when closing an incident; ignored by sources that do not surface classification reasons.

Available options:
InaccurateData,
IncorrectAlertLogic,
SuspiciousActivity,
SuspiciousButExpected,
Unknown,
Apt,
Malware,
SecurityPersonnel,
SecurityTesting,
UnwantedSoftware,
Other,
MultistagedAttack,
CompromisedUser,
Phishing,
MaliciousUserActivity,
NotMalicious,
NoEnoughDataToValidate,
ConfirmedUserActivity,
LineOfBusinessApplication,
null
updateTicket
boolean

When true, also closes the linked service ticket identified by string UpdateIncidentStatusRequest.TicketId.

ticketId
null | string

Linked service ticket id; required when bool UpdateIncidentStatusRequest.UpdateTicket is true.

Response

No Content