alerts_update_alerts
Update alert severity, status, or resolution comment for up to 100 alerts in a single request.
Instructions
Update Alerts
Update one or more alerts. You can update up to 100 alerts per request. Missing fields are ignored.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/alerts/update_alerts] · Incidents
Example request body:
{
"request_data": {
"alert_id_list": "<list of ids>",
"update_data": {
"severity": "medium",
"status": "resolved_other",
"comment": "This incident is resolved"
}
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | No | (Required) A dictionary containing the API request fields. An empty dictionary returns all results. |