---
title: "Create or update an indicator triage state"
method: POST
path: "/api/v2/security/siem/ioc-explorer/triage"
tags: ["Security Monitoring"]
---

# Create or update an indicator triage state

`POST /api/v2/security/siem/ioc-explorer/triage`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security/siem/ioc-explorer/triage`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_signals_write`

Set the triage state of an indicator of compromise (IoC). This creates or
updates the triage state for the indicator in your organization.

## Request body

- IoCTriageWriteRequest: Request body for creating or updating an indicator triage state.
  - `data` IoCTriageWriteRequestData, required: Data object for the triage write request.
    - `attributes` IoCTriageWriteRequestAttributes, required: Attributes for setting an indicator's triage state.
      - `indicator` string, required: The indicator value to triage (for example, an IP address or domain).
      - `triage_state` 'not_reviewed' | 'reviewed', required: Current triage state of the indicator.
    - `type` string, required: Triage state resource type.

## Response `201`

Created

- IoCTriageWriteResponse: Response for the create indicator triage state endpoint.
  - `data` IoCTriageWriteResponseData: Data object of the triage write response.
    - `attributes` IoCTriageWriteResponseAttributes: Attributes of a created or updated triage state.
      - `created_at` string, date-time: Timestamp when the triage record was created.
      - `indicator` string: The indicator value that was triaged.
      - `triage_state` 'not_reviewed' | 'reviewed': Current triage state of the indicator.
      - `triaged_at` string, date-time: Timestamp when the triage state was set.
      - `triaged_by` string: UUID of the user who set the triage state.
    - `id` string: Unique identifier for the triage state record.
    - `type` string: Triage state resource type.

## Other responses

- `400`: Bad Request
- `403`: Not Authorized
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)