Skip to main content
Change the verdict of a threat, as determined by a Console user.

​
Parameters

ParameterDescription
New Analyst VerdictThe new analyst verdict.
Options: 
false_positive
suspicious
true_positive
undefined
Threats IDsList of threats IDs to update their analyst verdict.

​
Example Output

{
	"data": {
		"affected": 1,
		"details": [
			{
				"result": "<string>",
				"threatId": "<string>"
			}
		]
	}
}

​
Workflow Library Example

Update Threat Analyst Verdict with Sentinelone and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop