---
title: "Change the triage state of a security signal"
method: PATCH
path: "/api/v2/security_monitoring/signals/{signal_id}/state"
tags: ["Security Monitoring"]
---

# Change the triage state of a security signal

`PATCH /api/v2/security_monitoring/signals/{signal_id}/state`

Change the triage state of a security signal.

## Path parameters

- `signal_id` string, required

## Request body

- SecurityMonitoringSignalStateUpdateRequest — Request body for changing the state of a given security monitoring signal.
  - `data` SecurityMonitoringSignalStateUpdateData, required — Data containing the patch for changing the state of a signal.
    - `attributes` SecurityMonitoringSignalStateUpdateAttributes, required — Attributes describing the change of state of a security signal.
      - `archive_comment` string — Optional comment to display on archived signals.
      - `archive_reason` 'none' | 'false_positive' | 'testing_or_maintenance' | 'remediated' | 'investigated_case_opened' | 'true_positive_benign' | 'true_positive_malicious' | 'other' — Reason a signal is archived.
      - `state` 'open' | 'archived' | 'under_review', required — The new triage state of the signal.
      - `version` integer — Version of the updated signal. If server side version is higher, update will be rejected.
    - `id` unknown
    - `type` 'signal_metadata' — The type of event.

## Response `200`

OK

- SecurityMonitoringSignalTriageUpdateResponse — The response returned after all triage operations, containing the updated signal triage data.
  - `data` SecurityMonitoringSignalTriageUpdateData, required — Data containing the updated triage attributes of the signal.
    - `attributes` SecurityMonitoringSignalTriageAttributes — Attributes describing a triage state update operation over a security signal.
      - `archive_comment` string — Optional comment to display on archived signals.
      - `archive_comment_timestamp` integer — Timestamp of the last edit to the comment.
      - `archive_comment_user` SecurityMonitoringTriageUser — Object representing a given user entity.
        - `handle` string — The handle for this user account.
        - `icon` string — Gravatar icon associated to the user.
        - `id` integer — Numerical ID assigned by Datadog to this user account.
        - `name` string, nullable — The name for this user account.
        - `uuid` string, required — UUID assigned by Datadog to this user account.
      - `archive_reason` 'none' | 'false_positive' | 'testing_or_maintenance' | 'remediated' | 'investigated_case_opened' | 'true_positive_benign' | 'true_positive_malicious' | 'other' — Reason a signal is archived.
      - `assignee` SecurityMonitoringTriageUser, required — Object representing a given user entity.
        - `handle` string — The handle for this user account.
        - `icon` string — Gravatar icon associated to the user.
        - `id` integer — Numerical ID assigned by Datadog to this user account.
        - `name` string, nullable — The name for this user account.
        - `uuid` string, required — UUID assigned by Datadog to this user account.
      - `incident_ids` integer[], required — Array of incidents that are associated with this signal.
      - `state` 'open' | 'archived' | 'under_review', required — The new triage state of the signal.
      - `state_update_timestamp` integer — Timestamp of the last update to the signal state.
      - `state_update_user` SecurityMonitoringTriageUser — Object representing a given user entity.
        - `handle` string — The handle for this user account.
        - `icon` string — Gravatar icon associated to the user.
        - `id` integer — Numerical ID assigned by Datadog to this user account.
        - `name` string, nullable — The name for this user account.
        - `uuid` string, required — UUID assigned by Datadog to this user account.
    - `id` string — The unique ID of the security signal.
    - `type` 'signal_metadata' — The type of event.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `404` — Not Found
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)