bulk_update_alerts
Update multiple alerts simultaneously by modifying status, assignee, or adding comments to streamline security incident management workflows.
Instructions
Bulk update multiple alerts with status, assignee, and/or comment changes.
This tool allows you to efficiently update multiple alerts at once by setting their status, assignee, and adding a comment. At least one of status, assignee_id, or comment must be provided.
Returns: Dict containing: - success: Boolean indicating overall success - results: Dict with operation results: - status_updates: List of alert IDs successfully updated with new status - assignee_updates: List of alert IDs successfully updated with new assignee - comments_added: List of alert IDs that successfully received comments - failed_operations: List of failed operations with error details - summary: Dict with counts of successful and failed operations - message: Error message if unsuccessful
Permissions:{'all_of': ['Manage Alerts']}
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alert_ids | Yes | List of alert IDs to update (maximum 25) | |
| status | No | Optional new status for the alerts | |
| assignee_id | No | Optional ID of the user to assign the alerts to | |
| comment | No | Optional comment to add to all alerts |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||