Resolve a finding for your MSP sub-account

post/msp/accounts/{account_id}/findings/{finding_id}/resolve

Request

  • Base URL: https://api.blumira.com/public-api/v1
  • URL: https://api.blumira.com/public-api/v1/msp/accounts/{account_id}/findings/{finding_id}/resolve
  • Auth: HTTP bearer

Path parameters

account_idstring uuid required

Account ID of the object, e.g., "00110011-0000-0000-0000-000000000000"

finding_idstring uuid required

Finding ID of the object, e.g., "00110011-0000-0000-0000-000000000000"

Headers

Authorizationstring required

Bearer followed by JWT, e.g., "Bearer eyJh...enA"

Request body

resolutioninteger required

Resolution ID (e.g., 10=Valid, 20=False Positive, 30=No Action Needed, 40=Risk Accepted)

resolution_notesstring

Optional notes related to the resolution

Example request

{
  "resolution": 10,
  "resolution_notes": "Resolved after investigation"
}

Response

Finding with updated resolution

analysisstring

Finding analysis

blockedboolean

Whether the finding is blocked. Optional; present on details.

categoryinteger

Numeric category ID (e.g. for category_name). Optional; present on details.

confirmation_completedstring date-time nullable

When confirmation was completed. Optional; present on details.

createdstring date-time

When the finding was created

escalation_completedstring date-time nullable

When escalation was completed. Optional; present on details.

finding_idstring uuid

ID of finding

jurisdictioninteger

Numeric jurisdiction ID (e.g. for jurisdiction_name). Optional; present on details.

match_idstring uuid nullable

ID of the BDF match associated with this finding (used for evidence). Omitted or null if not available.

matchedstring date-time nullable

When the finding was matched. Optional; present on details.

mitigation_completedstring date-time nullable

When mitigation was completed. Optional; present on details.

modifiedstring date-time

When the finding was modified

namestring

Name of the finding

org_idstring uuid

ID of org associated with this finding

org_namestring nullable

Name of org associated with this finding (null for POC org path)

priorityinteger

Priority of finding (range 1-5)

promoted_to_idstring uuid nullable

ID of the finding this was promoted to, if any. Optional; present on details.

seconds_in_statusinteger

Seconds the finding has been in its current status. Optional; present on details.

seconds_to_statusinteger

Seconds until a status transition (if applicable). Optional; present on details.

short_idstring

Short identifier for the finding

statusinteger

Numeric status code (e.g., 40 = Resolved)

status_modifiedstring date-time nullable

When the status was last modified. Optional; present on details.

status_namestring

Status of the finding (e.g., "Open", "Analysis in Progress", "Resolved", etc.)

typeinteger

Numeric type ID (e.g. for type_name). Optional; present on details.

type_namestring

Type of finding (e.g, "Suspect", "Threat", etc.)

ui_action_typeinteger

ID of action that the UI should take when rendering this finding. Optional; present on details. Also expanded as ui_action object.

category_namestring

Category of the finding (e.g., "Malicious Code", "Unauthorized Access Attempt", etc.)

confirmationobject[]

Workflow for confirmation (array of step objects). Pass-through from finding service.

escalationobject[]

Workflow for escalation (array of step objects). Pass-through from finding service.

jurisdiction_namestring

Jurisdiction of the finding (e.g., "administrator", "responder", etc.)

mitigationobject[]

Workflow for mitigation (array of step objects). Pass-through from finding service.

org_location_idsstring[]

Array of org location UUIDs (finding service pass-through).

owners_by_emailobject[] nullable

Owners of the finding by email. Pass-through from finding service.

related_findingsstring[]

Finding UUIDs related to this finding. Pass-through from finding service.

resolutioninteger

Resolution ID (e.g., 10=Valid, 20=False Positive, 30=No Action Needed, 40=Risk Accepted)

resolution_namestring

Resolution of the finding (e.g., "Valid", "False Positive", etc.)

resolution_notesstring

Any notes related to the resolution

src_countrystring[]

Two-letter country codes implicated in the finding. Pass-through from finding service.

summarystring

Executive summary of the finding (<=512 characters)

urlstring

UI URL to the finding

Example response

{
  "analysis": "Blumira has detected a portscan from 192.168.26.121 to 192.168.2.203 over 1, 4, 37, 9, and 2 others port(s) from an advanced raw query detector.",
  "created": "2015-07-07T15:49:51.230",
  "finding_id": "aff08432-80ae-8fbe-bcd0-399beb09c6f1",
  "modified": "2015-07-07T15:49:51.230",
  "name": "Active Directory Domain Admin Created",
  "org_id": "aff08432-80ae-8fbe-bcd0-399beb09c6f1",
  "org_name": "My Organization",
  "priority": 4,
  "short_id": "F-24-16-B4B6",
  "status": 40,
  "status_name": "Open",
  "type_name": "Suspect",
  "ui_action_type": 20,
  "category_name": "Malicious Code",
  "jurisdiction_name": "administrator",
  "resolution": 10,
  "resolution_name": "Valid",
  "summary": "Detects potentially innapropriately created domain administrators through Event ID.",
  "url": "https://app.blumira.com/f0eee000-0000-0000-0000-c0ffee000001/query/findings/ffffffff-1111-2555-0000-000000000001"
}

Changes

No recorded changes to this operation across all 1 revision of this API.