Closing alerts

POST /api/v1/alerts/close

The target correlator must be running.

Access: General administrator, Tenant administrator, Tier 2 analyst, Tier 1 analyst, Junior analyst, Interaction with NCIRCC, Access to CII.

Request body

Format: JSON

Name

Data type

Mandatory

Description

Value example

id

string

Yes

Alert ID

00000000-0000-0000-0000-000000000000

reason

string

Yes

Reason for closing the alert

responded, incorrect data, incorrect correlation rule

Response

HTTP code: 204

Possible errors

HTTP code

Description

message field value

details field value

400

Alert ID is not specified

id required

 

400

The reason for closing the alert is not specified

reason required

 

400

Invalid value of the "reason" parameter

invalid reason

 

403

The user does not have the required role in the alert tenant

access denied

 

404

Alert not found

alert not found

 

406

Alert tenant disabled

tenant disabled

 

406

Alert already closed

alert already closed

 

500

Any other internal errors

variable

variable

Page top