WAwatchguard
Update Incident Status

Updates the incident status.

Updates the status of a specific incident.

patch/v1/{accountId}/incidents/{incidentId}

Request

Path parameters

accountIdstring required

Your WatchGuard Cloud Account ID.

incidentIdstring required

ID of an incident.

Request body

statusstring required

Updated incident status. This can be one of these values:

  • new - New incidents not yet reviewed.
  • read - Reviewed incidents or incidents marked as read.
  • closed - Incidents closed by an automation policy or manual action.
commentstring

Comment on an incident.

Example request

{
  "status": "closed",
  "comment": "sample comment"
}

Response

Successful response.

idstring

ID of the incident.

accountstring

Account ID.

categorystring

Category of the incident.

typestring

Specific type of incident within an incident category.

timestampstring

Date and time the incident was created.

threatScoreinteger

Threat score of incident.

severitystring

The severity of the incident. Possible values are Low, Medium, High, and Critical.

descriptionstring

A description of the incident.

remediatedboolean

Remediation status of the incident.

entityIdsstring[]
statusstring

Specifies the status of the incident. This can be one of these values:

  • new - New incidents not yet reviewed.
  • read - Reviewed incidents or incidents marked as read.
  • closed - Incidents closed by an automation policy or manually closed.
lastUpdateTimestring

The date and time (in UTC) when the incident status was last changed.

updatedBystring

The name of the operator that updated the incident status. Or "system" if the update was in response to an automated action.

Example response

{
  "id": "cg0f0s2h7skomt847f1g",
  "account": "WCG-1-123abc456 or ACC-1234567",
  "category": "malware",
  "type": "Panda.SpywareB.TestFile",
  "timestamp": "2023-03-02T18:52:20Z",
  "threatScore": 5,
  "severity": "Medium",
  "entities": {
    "8ed6cbce746d4597A6469bbc0c4edce9": {
      "type": "endpoint",
      "recommendedActions": [
        {
          "command": "isolate"
        },
        {
          "command": "quarantineFile",
          "parameters": {
            "md5": "E76A3640348DC959CB4D87C81F27A1A1"
          }
        }
      ],
      "actionPerformed": {
        "command": "deleteFile",
        "parameters": {
          "md5": "E76A3640348DC959CB4D87C81F27A1A1"
        }
      },
      "threatDetails": {
        "malware": "Panda.SpywareB.TestFile",
        "file": "DESKTOPDIRECTORY|\\\\WESS tools\\\\malware\\\\Spy.EXE",
        "md5": "E76A3640348DC959CB4D87C81F27A1A1"
      }
    }
  },
  "entityIds": [
    "8ed6cbce-746d-4597-a646-9bbc0c4edce9"
  ],
  "status": "closed",
  "lastUpdateTime": "2023-09-27T06:21:43Z",
  "updatedBy": "ffc1c30697abdc4e_rw_id"
}

Changes

No recorded changes to this operation across all 1 revision of this API.