Security Attack discovery API

Bulk update Attack discoveries

Changed on

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_bulk</span></div>

Refer to Spaces for more information.

Performs bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings. This endpoint allows efficient batch processing of alert modifications without requiring individual API calls for each alert.

post/api/attack_discovery/_bulk

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/attack_discovery/_bulk
  • Auth
    • API key in header Authorization
    • or HTTP basic

Request body

Example request

{
  "update": {
    "ids": [
      "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
      "5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7"
    ],
    "kibana_alert_workflow_status": "acknowledged",
    "visibility": "shared",
    "with_replacements": true
  }
}

Response

Indicates a successful call.

Example response

{
  "data": [
    {
      "timestamp": "2023-10-31T12:00:00Z",
      "users": [
        {
          "id": "user123",
          "name": "John Doe"
        }
      ]
    }
  ]
}

Changes