Skip to main content

Update Alerts

Update an alert or multiple ones. Allows you to update the status, assign it to a user, add comments with additional info, ect.

The following permission is required to run this action:

  • Alerts: Read and Write.
note

This endpoint does not support detection IDs prefixed with ldt.

External Documentation

To learn more, visit the CrowdStrike documentation.

Parameters​

ParameterDescription
Action ParametersA comma-separated list of the parameters for the prospective action.As you work on an alert, you’ll often need to update the status, assign it to a user, or add comments with additional info.In most cases, you must provide both the action name, such as updatestatus, and a value, such as inprogress, in the body of the request. Some actions accept empty values.You can perform these actions on alerts:
  • add_tag: Add a tag (keyword) to the specified alerts.
  • append_comment: Appends a new comment to any existing comments for the specified alerts.
  • assign_to_name: Assign the specified alerts to a user based on their username.
  • assign_to_user_id: Assign the specified alerts to a user based on their email address.
  • assign_to_uuid: Assign the specified alerts to a user based on their UUID.
  • remove_tag: Remove a tag from the specified alerts.
  • remove_tags_by_prefix: Remove all tags containing a given prefix from the specified alerts.
  • show_in_ui: If the value specified is true, display the specified alerts in the Falcon console. Any other value, including an empty value, prevents the specified alerts from appearing in the Falcon console.
  • unassign: If there are any users currently assigned to the specified alerts, unassign them.
This action doesn’t require a value; if one is specified, the value is ignored.
  • update_status: Update the status for the specified alerts.Valid statuses are:
     - closed - in_progress - new - reopened
Alert IDsComma separated list of alert IDs to get details on. This endpoint does not support detection IDs prefixed with ldt.

Example Output​

{
    "meta": {
        "query_time": 0.209774393,
        "writes": {
            "resources_affected": 2
        },
        "powered_by": "detectsapi",
        "trace_id": "8326daf7-d03a-4268-a6f9-8e7195a50ec6"
    }
}

Workflow Library Example​

Update Alerts with Crowdstrike and Send Results Via Email

Workflow LibraryPreview this Workflow on desktop