---
title: "Bulk update security signals"
method: PATCH
path: "/api/v2/security_monitoring/signals/bulk/update"
tags: ["Security Monitoring"]
---

# Bulk update security signals

`PATCH /api/v2/security_monitoring/signals/bulk/update`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/signals/bulk/update`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token`

Update the triage state or assignee of multiple security signals at once.
The maximum number of signals that can be updated in a single request is 199.

## Request body

- SecurityMonitoringSignalsBulkUpdateRequest: Request body for updating multiple attributes of multiple security signals.
  - `data` SecurityMonitoringSignalsBulkUpdateData[], required: An array of signal updates.
    - `attributes` SecurityMonitoringSignalUpdateAttributes, required: Attributes for updating the triage state or assignee of a security signal.
      - `archive_comment` string: Optional comment to display on archived signals.
      - `archive_reason` 'none' | 'false_positive' | 'testing_or_maintenance' | 'remediated' | 'investigated_case_opened' | 'true_positive_benign' | 'true_positive_malicious' | 'other': Reason a signal is archived.
      - `assignee` SecurityMonitoringTriageUser: Object representing a given user entity.
        - `handle` string: The handle for this user account.
        - `icon` string: Gravatar icon associated to the user.
        - `id` integer: Numerical ID assigned by Datadog to this user account.
        - `name` string, nullable: The name for this user account.
        - `uuid` string, required: UUID assigned by Datadog to this user account.
      - `state` 'open' | 'archived' | 'under_review': The new triage state of the signal.
      - `version` integer: Version of the updated signal. If server side version is higher, update will be rejected.
    - `id` string, required: The unique ID of the security signal.
    - `type` 'signal': The type of event.

## Response `200`

OK

- SecurityMonitoringSignalsBulkTriageUpdateResponse: Response for a bulk triage update of security signals.
  - `result` SecurityMonitoringSignalsBulkTriageUpdateResult, required: The result payload of a bulk signal triage update.
    - `count` integer, required: The number of signals updated.
    - `events` SecurityMonitoringSignalsBulkTriageEvent[], required: The list of updated signals.
      - `event` SecurityMonitoringSignalsBulkTriageEventAttributes, required: Triage attributes of a security signal returned in a bulk update response.
        - `archive_comment` string: Optional comment to display on archived signals.
        - `archive_comment_timestamp` integer: Timestamp of the last edit to the archive comment.
        - `archive_comment_user` SecurityMonitoringTriageUser: Object representing a given user entity.
          - `handle` string: The handle for this user account.
          - `icon` string: Gravatar icon associated to the user.
          - `id` integer: Numerical ID assigned by Datadog to this user account.
          - `name` string, nullable: The name for this user account.
          - `uuid` string, required: UUID assigned by Datadog to this user account.
        - `archive_reason` 'none' | 'false_positive' | 'testing_or_maintenance' | 'remediated' | 'investigated_case_opened' | 'true_positive_benign' | 'true_positive_malicious' | 'other': Reason a signal is archived.
        - `assignee` SecurityMonitoringTriageUser, required: Object representing a given user entity.
          - `handle` string: The handle for this user account.
          - `icon` string: Gravatar icon associated to the user.
          - `id` integer: Numerical ID assigned by Datadog to this user account.
          - `name` string, nullable: The name for this user account.
          - `uuid` string, required: UUID assigned by Datadog to this user account.
        - `id` string, required: The unique ID of the security signal.
        - `incident_ids` integer[], required: Array of incidents that are associated with this signal.
        - `state` 'open' | 'archived' | 'under_review', required: The new triage state of the signal.
        - `state_update_timestamp` integer: Timestamp of the last state update.
        - `state_update_user` SecurityMonitoringTriageUser: Object representing a given user entity.
          - `handle` string: The handle for this user account.
          - `icon` string: Gravatar icon associated to the user.
          - `id` integer: Numerical ID assigned by Datadog to this user account.
          - `name` string, nullable: The name for this user account.
          - `uuid` string, required: UUID assigned by Datadog to this user account.
      - `id` string, required: The unique ID of the security signal.
  - `status` string, required: The status of the bulk operation.
  - `type` string, required: The type of the response.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)