incidents_update_incident
Update an incident's fields in Cortex XSIAM by providing incident ID and update data. Modify status, assignee, severity, notes, or add comments to resolve incidents.
Instructions
Update an Incident
Update one or more fields of a specific incident. Missing fields are ignored. Note:
assigned_user_mailfield is validated by Cortex XSIAM to confirm the provided assignee email address belongs to a user that exists in the same Cortex XSIAM tenant.To unassign an incident pass
noneor"assigned_user_mail": "".To remove a manually set severity pass
noneor"manual_severity": "".
[POST /public_api/v1/incidents/update_incident] · Incidents
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | No |