Update Alerts - BlinkOps Documentation

Update one or more alerts. Note: You must provide at least one of: Status, Assignee, Verdict, Verdict Reasoning, Severity, or Comment.

External DocumentationTo learn more, visit the Vega documentation.

Parameters

Parameter	Description
Alert IDs	A comma-separated list of alert IDs to update. Can be obtained using the `List Alerts` action.
Assignee Emails	A comma-separated list of user emails to assign to the alerts.
Comment	The comment to append after all other changes are applied.
Remove Or Edit Assignees	Select whether to remove all assignees or edit the assignee list.
Severity	Select the severity to set on the alerts.
Status	Select the status to set on the alerts.
Verdict	Select the verdict to set.
Verdict Reasoning	The reasoning for the verdict being applied.

Example Output

{
	"data": {
		"updateAlerts": {
			"alerts": [
				{
					"id": "<string>",
					"vegaAlertId": "<string>",
					"detectionId": "<string>",
					"name": "<string>",
					"severity": "LOW",
					"status": "OPEN",
					"assignees": [
						{
							"userId": "<string>",
							"displayName": "<string>",
							"email": "<string>"
						}
					],
					"dataSources": [
						"<string>"
					],
					"createdAt": "2024-01-15T09:30:00Z",
					"updatedAt": "2024-01-15T09:30:00Z",
					"relatedIncidents": [
						{
							"incidentId": "<string>",
							"name": "<string>"
						}
					],
					"detectionSource": "<string>",
					"detectionDescription": "<string>",
					"detectionQuery": "<string>",
					"isTestMode": true,
					"verdict": "NA",
					"comments": [
						{
							"text": "<string>",
							"addedBy": "<string>",
							"addedAt": "2024-01-15T09:30:00Z"
						}
					],
					"description": "<string>",
					"assignee": {
						"userId": "<string>",
						"displayName": "<string>",
						"email": "<string>"
					},
					"mitre": {
						"mitreTactics": [
							"<string>"
						],
						"mitreTechniques": [
							"<string>"
						]
					},
					"eventCount": 123,
					"verdictReasoning": "<string>",
					"dedupCount": 123
				}
			],
			"error": {
				"code": "<string>",
				"message": "<string>"
			}
		}
	}
}

Workflow Library Example

Update Alerts with Vega and Send Results Via Email

Preview this Workflow on desktop

List Incidents Update Incidents

⌘I

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example