Security Attack discovery API

Bulk update Attack discoveries

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_bulk</span></div>

Refer to Spaces for more information.

Performs bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings. This endpoint allows efficient batch processing of alert modifications without requiring individual API calls for each alert.

post/api/attack_discovery/_bulk

Request body

Example request

{
  "update": {
    "ids": [
      "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
      "5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7"
    ],
    "kibana_alert_workflow_status": "acknowledged",
    "visibility": "shared",
    "with_replacements": true
  }
}

Response

Indicates a successful call.

Example response

{
  "data": [
    {
      "timestamp": "2023-10-31T12:00:00Z",
      "users": [
        {
          "id": "user123",
          "name": "John Doe"
        }
      ]
    }
  ]
}

Changes

Changed in 1 of the 176 revisions of this API.1

    • ○

      added the optional property // to the response with the status

      response-optional-property-added

Of the 176 revisions, 20 have no diff computed.