Query

Acknowledge Alerts

Acknowledges the alert event(s) matching the given query. Note that this will not remove the event from connected SOC users' Alert screens when the same alert event happens to be also present on their Alert screen. However, if they refresh the Alert screen the alert event will no longer be listed.

post/connect/events/ack

Request body

acknowledgeboolean

Whether to acknowledge or unacknowledge the events: true = acknowledge, false = unacknowledge

dateRangestring

The date range to use for searching for matching events

dateRangeFormatstring

The date range format. If unsure how to use this then use the example value exactly as shown.

escalateboolean

Whether the events have also been escalated to a case: true = escalated, false = has not been escalated

eventFilterobject

Optional event filters to further narrow down matching events to acknowledge. These are field:value pairs.

searchFilterstring

The search filter to utilize when searching for matching events to acknowledge.

timezonestring

The timezone to use with the date range

Example request

{
  "acknowledge": true,
  "dateRange": "2024/12/03 02:31:35 PM - 2024/12/04 02:31:35 PM",
  "dateRangeFormat": "2006/01/02 3:04:05 PM",
  "eventFilter": {
    "event.module": "sigma",
    "rule.name": "Security Onion - SOC Login Failure",
    "rule.uuid": "bf86ef21-41e6-417b-9a05-b9ea6bf28a38"
  },
  "searchFilter": "tags:alert AND NOT event.acknowledged:true AND NOT event.escalated:true | groupby rule.name event.module* event.severity_label rule.uuid",
  "timezone": "America/New_York"
}

Response

Outputs the list of update results

completeTimestring

The date and time when the search completed

createTimestring

The date and time when the search was submitted

elapsedMsinteger

The number of milliseconds it took to complete the search

errorsstring[]

A list of errors that the search encountered. The presence of errors does not necessarily preclude the search from returning events."

unchangedCountinteger

The number of events the were left unmodified

updatedCountinteger

The number of events that were updated

Example response

{
  "completeTime": "2024-12-04T19:54:33.822293482Z",
  "createTime": "2024-12-04T19:54:33.519514906Z",
  "criteria": {
    "beginTime": "2024-12-03T14:31:35-05:00",
    "createTime": "2024-12-04T19:31:42.73865332Z",
    "endTime": "2024-12-04T14:31:35-05:00",
    "eventLimit": 100,
    "metricLimit": 10,
    "query": "(*) AND tags:alert AND NOT event.acknowledged:true AND NOT event.escalated:true | groupby rule.name event.module* event.severity_label rule.uuid",
    "updateScripts": [
      "<Painless Script Syntax>"
    ]
  },
  "elapsedMs": 299,
  "errors": [
    "all shards failed"
  ],
  "updatedCount": 1
}

Changes

Changed in 3 of the 23 revisions of this API.37

Aug 25, 20254e3bdeaab6cb3See the full diff
- ●
  removed the optional property criteria/parsedQuery from the response with the 200 status
  response-optional-property-removed
- ●
  removed the optional property criteria/searchAfter from the response with the 200 status
  response-optional-property-removed
- ●
  removed the optional property criteria/sortFields from the response with the 200 status
  response-optional-property-removed
This revision also has 2 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Jan 15, 20250600bede2a742See the full diff
- ○
  api tag Query added
  api-tag-added
- ○
  api tag Events removed
  api-tag-removed
Dec 10, 2024ee1120fd1e205See the full diff
- ○
  api tag Events added
  api-tag-added
- ○
  api tag Query removed
  api-tag-removed
- ○
  added the optional property criteria/parsedQuery to the response with the 200 status
  response-optional-property-added
- ○
  added the optional property criteria/searchAfter to the response with the 200 status
  response-optional-property-added
- ○
  added the optional property criteria/sortFields to the response with the 200 status
  response-optional-property-added
This revision also has 35 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history