Skip to main content
Update an alert or multiple ones. Allows you to update the status, assign it to a user, add comments with additional info, ect. The following permission is required to run this action:
  • Alerts: Read and Write.
This endpoint does not support detection IDs prefixed with ldt.
External DocumentationTo learn more, visit the CrowdStrike documentation.

​
Parameters

ParameterDescription
Action ParametersA comma-separated list of the parameters for the prospective action.
As you work on an alert, you’ll often need to update the status, assign it to a user, or add comments with additional info.

In most cases, you must provide both the action name, such as update_status, and a value, such as in_progress, in the body of the request. Some actions accept empty values.

You can perform these actions on alerts:

- add_tag: Add a tag (keyword) to the specified alerts.

- append_comment: Appends a new comment to any existing comments for the specified alerts.

- assign_to_name: Assign the specified alerts to a user based on their username.

- assign_to_user_id: Assign the specified alerts to a user based on their email address.

- assign_to_uuid: Assign the specified alerts to a user based on their UUID.

- remove_tag: Remove a tag from the specified alerts.

- remove_tags_by_prefix: Remove all tags containing a given prefix from the specified alerts.

- show_in_ui: If the value specified is true, display the specified alerts in the Falcon console. Any other value, including an empty value, prevents the specified alerts from appearing in the Falcon console.

- unassign: If there are any users currently assigned to the specified alerts, unassign them.

This action doesn’t require a value; if one is specified, the value is ignored.

- update_status: Update the status for the specified alerts.
Valid statuses are:
- closed
- in_progress
- new
- reopened
Alert IDsComma separated list of alert IDs to get details on. This endpoint does not support detection IDs prefixed with ldt.

​
Example Output

{
	"meta": {
		"query_time": 0.209774393,
		"writes": {
			"resources_affected": 2
		},
		"powered_by": "detectsapi",
		"trace_id": "8326daf7-d03a-4268-a6f9-8e7195a50ec6"
	}
}

​
Workflow Library Example

Update Alerts with Crowdstrike and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop