update_alert_assignee
DestructiveIdempotent
Change the assigned user for security alerts by specifying alert IDs and the new assignee's ID to manage alert ownership and response responsibilities.
Instructions
Update the assignee of one or more alerts through the assignee's ID.
Returns: Dict containing: - success: Boolean indicating if the update was successful - alerts: List of updated alert IDs if successful - message: Error message if unsuccessful
Permissions:{'all_of': ['Manage Alerts']}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alert_ids | Yes | List of alert IDs to update | |
| assignee_id | Yes | The ID of the user to assign the alerts to |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- src/mcp_panther/panther_mcp_core/tools/alerts.py:578-584 (registration)Registers the 'update_alert_assignee' tool using the @mcp_tool decorator from the tools registry, specifying ALERT_MODIFY permissions and destructive/idempotent hints.
@mcp_tool( annotations={ "permissions": all_perms(Permission.ALERT_MODIFY), "destructiveHint": True, "idempotentHint": True, } ) - Input schema defined using Pydantic Annotated types with Field descriptions for alert_ids (list of strings) and assignee_id (string with min_length 1).
alert_ids: Annotated[ list[str], Field(description="List of alert IDs to update"), ], assignee_id: Annotated[ str, Field(min_length=1, description="The ID of the user to assign the alerts to"), ], ) -> dict[str, Any]: - The handler function that implements the tool logic: logs the action, prepares PATCH body with ids and assignee, calls client.patch('/alerts'), handles 404/400 errors and exceptions, returns success with alert IDs or error message.
async def update_alert_assignee( alert_ids: Annotated[ list[str], Field(description="List of alert IDs to update"), ], assignee_id: Annotated[ str, Field(min_length=1, description="The ID of the user to assign the alerts to"), ], ) -> dict[str, Any]: """Update the assignee of one or more alerts through the assignee's ID. Returns: Dict containing: - success: Boolean indicating if the update was successful - alerts: List of updated alert IDs if successful - message: Error message if unsuccessful """ logger.info(f"Updating assignee for alerts {alert_ids} to user {assignee_id}") try: # Prepare request body body = { "ids": alert_ids, "assignee": assignee_id, } # Execute the REST API call async with get_rest_client() as client: result, status = await client.patch( "/alerts", json_data=body, expected_codes=[204, 400, 404] ) if status == 404: logger.error(f"One or more alerts not found: {alert_ids}") return { "success": False, "message": f"One or more alerts not found: {alert_ids}", } if status == 400: logger.error(f"Bad request when updating alert assignee: {alert_ids}") return { "success": False, "message": f"Bad request when updating alert assignee: {alert_ids}", } logger.info(f"Successfully updated assignee for alerts {alert_ids}") return { "success": True, "alerts": alert_ids, # Return the IDs that were updated } except Exception as e: logger.error(f"Failed to update alert assignee: {str(e)}") return { "success": False, "message": f"Failed to update alert assignee: {str(e)}", }