Update incident status

curl --request PUT \ --url https://api.example.com/api/v2/workspaces/{workspaceId}/incidents/{source}/{incidentId}/status \ --header 'Content-Type: application/json' \ --data ' { "comment": "<string>", "updateTicket": true, "ticketId": "<string>" } '

{ "type": "<string>", "title": "<string>", "status": 123, "detail": "<string>", "instance": "<string>", "code": "<string>", "requestId": "<string>", "timestamp": "<string>", "target": "<string>", "errors": {} }

Path Parameters

workspaceId

string<uuid>

required

source

enum<string>

required

Available options:

Sentinel,

DefenderXDR,

QRadar,

Splunk,

CrowdStrike,

SentinelOne

incidentId

string

required

Body

application/json

v2 request body for updating an incident's status.

status

enum<string>

required

New status to apply to the incident.

Available options:

Active,

New,

Closed

comment

null | string

Optional comment recorded alongside the status change. Recommended when transitioning to Status.Closed.

classification

null | any

Required by Sentinel when closing an incident; ignored by sources that do not surface classifications.

Available options:

BenignPositive,

FalsePositive,

TruePositive,

Undetermined,

InformationalExpectedActivity,

Unknown,

NonIssue,

PolicyViolation,

QradarFalsePositive,

Undefined,

Suspicious,

null

classificationReason

null | any

Required by Sentinel when closing an incident; ignored by sources that do not surface classification reasons.

Available options:

InaccurateData,

IncorrectAlertLogic,

SuspiciousActivity,

SuspiciousButExpected,

Unknown,

Apt,

Malware,

SecurityPersonnel,

SecurityTesting,

UnwantedSoftware,

Other,

MultistagedAttack,

CompromisedUser,

Phishing,

MaliciousUserActivity,

NotMalicious,

NoEnoughDataToValidate,

ConfirmedUserActivity,

LineOfBusinessApplication,

null

updateTicket

boolean

When true, also closes the linked service ticket identified by string UpdateIncidentStatusRequest.TicketId.

ticketId

null | string

Linked service ticket id; required when bool UpdateIncidentStatusRequest.UpdateTicket is true.

Response

No Content