snooze_occurrence
Snooze a specific issue occurrence to pause alerts, using a reason like false positive or accepted risk and an optional duration.
Instructions
Snooze a specific occurrence of an issue.
To snooze a whole issue, list its occurrences with list_occurrences and snooze each one.
Args:
issue_id: The ID of the issue
occurrence_id: The ID of the occurrence to snooze
reason: Reason for snoozing (required, must be one of ACCEPT_RISK, FALSE_POSITIVE, MITIGATING_CONTROLS)
details: Optional free-text details for the snooze
duration: Optional number of duration_type units to snooze for (ignored when duration_type is 'forever')
duration_type: Optional duration type, one of 'forever', 'day', 'week', 'month'
The reasons mean:
- ACCEPT_RISK - Risk accepted for this specific occurrence
- FALSE_POSITIVE - False positive - occurrence has been verified as not exploitable
- MITIGATING_CONTROLS - Mitigating controls are in place for this occurrence
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| reason | Yes | ||
| details | No | ||
| duration | No | ||
| issue_id | Yes | ||
| duration_type | No | ||
| occurrence_id | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |