Status, Assignee, Verdict, Verdict Reasoning, Severity, or Comment.
External DocumentationTo learn more, visit the Vega documentation.
Parameters
| Parameter | Description |
|---|---|
| Alert IDs | A comma-separated list of alert IDs to update. Can be obtained using the List Alerts action. |
| Assignee Emails | A comma-separated list of user emails to assign to the alerts. |
| Comment | The comment to append after all other changes are applied. |
| Remove Or Edit Assignees | Select whether to remove all assignees or edit the assignee list. |
| Severity | Select the severity to set on the alerts. |
| Status | Select the status to set on the alerts. |
| Verdict | Select the verdict to set. |
| Verdict Reasoning | The reasoning for the verdict being applied. |
Example Output
{
"data": {
"updateAlerts": {
"alerts": [
{
"id": "<string>",
"vegaAlertId": "<string>",
"detectionId": "<string>",
"name": "<string>",
"severity": "LOW",
"status": "OPEN",
"assignees": [
{
"userId": "<string>",
"displayName": "<string>",
"email": "<string>"
}
],
"dataSources": [
"<string>"
],
"createdAt": "2024-01-15T09:30:00Z",
"updatedAt": "2024-01-15T09:30:00Z",
"relatedIncidents": [
{
"incidentId": "<string>",
"name": "<string>"
}
],
"detectionSource": "<string>",
"detectionDescription": "<string>",
"detectionQuery": "<string>",
"isTestMode": true,
"verdict": "NA",
"comments": [
{
"text": "<string>",
"addedBy": "<string>",
"addedAt": "2024-01-15T09:30:00Z"
}
],
"description": "<string>",
"assignee": {
"userId": "<string>",
"displayName": "<string>",
"email": "<string>"
},
"mitre": {
"mitreTactics": [
"<string>"
],
"mitreTechniques": [
"<string>"
]
},
"eventCount": 123,
"verdictReasoning": "<string>",
"dedupCount": 123
}
],
"error": {
"code": "<string>",
"message": "<string>"
}
}
}
}