Skip to main content
Update one or more alerts. Note: You must provide at least one of: Status, Assignee, Verdict, Verdict Reasoning, Severity, or Comment.
External DocumentationTo learn more, visit the Vega documentation.

​
Parameters

ParameterDescription
Alert IDsA comma-separated list of alert IDs to update. Can be obtained using the List Alerts action.
Assignee EmailsA comma-separated list of user emails to assign to the alerts.
CommentThe comment to append after all other changes are applied.
Remove Or Edit AssigneesSelect whether to remove all assignees or edit the assignee list.
SeveritySelect the severity to set on the alerts.
StatusSelect the status to set on the alerts.
VerdictSelect the verdict to set.
Verdict ReasoningThe reasoning for the verdict being applied.

​
Example Output

{
	"data": {
		"updateAlerts": {
			"alerts": [
				{
					"id": "<string>",
					"vegaAlertId": "<string>",
					"detectionId": "<string>",
					"name": "<string>",
					"severity": "LOW",
					"status": "OPEN",
					"assignees": [
						{
							"userId": "<string>",
							"displayName": "<string>",
							"email": "<string>"
						}
					],
					"dataSources": [
						"<string>"
					],
					"createdAt": "2024-01-15T09:30:00Z",
					"updatedAt": "2024-01-15T09:30:00Z",
					"relatedIncidents": [
						{
							"incidentId": "<string>",
							"name": "<string>"
						}
					],
					"detectionSource": "<string>",
					"detectionDescription": "<string>",
					"detectionQuery": "<string>",
					"isTestMode": true,
					"verdict": "NA",
					"comments": [
						{
							"text": "<string>",
							"addedBy": "<string>",
							"addedAt": "2024-01-15T09:30:00Z"
						}
					],
					"description": "<string>",
					"assignee": {
						"userId": "<string>",
						"displayName": "<string>",
						"email": "<string>"
					},
					"mitre": {
						"mitreTactics": [
							"<string>"
						],
						"mitreTechniques": [
							"<string>"
						]
					},
					"eventCount": 123,
					"verdictReasoning": "<string>",
					"dedupCount": 123
				}
			],
			"error": {
				"code": "<string>",
				"message": "<string>"
			}
		}
	}
}

​
Workflow Library Example

Update Alerts with Vega and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop