Change the triage state of a security signal

PATCH {{baseUrl}}/api/v2/security_monitoring/signals/:signal_id/state

Change the triage state of a security signal.

Request Body

{"data"=>{"attributes"=>{"state"=>"open", "archive_comment"=>"<string>", "archive_reason"=>"other", "version"=>"<long>"}, "id"=>{"description"=>"The unique ID of the security signal."}, "type"=>"signal_metadata"}}

HEADERS

KeyDatatypeRequiredDescription
Content-Typestring
Acceptstring

RESPONSES

status: OK

{&quot;data&quot;:{&quot;attributes&quot;:{&quot;assignee&quot;:{&quot;uuid&quot;:&quot;\u003cstring\u003e&quot;,&quot;handle&quot;:&quot;\u003cstring\u003e&quot;,&quot;icon&quot;:&quot;\u003cstring\u003e&quot;,&quot;id&quot;:&quot;\u003clong\u003e&quot;,&quot;name&quot;:&quot;\u003cstring\u003e&quot;},&quot;state&quot;:&quot;archived&quot;,&quot;incident_ids&quot;:[&quot;\u003clong\u003e&quot;,&quot;\u003clong\u003e&quot;],&quot;archive_comment&quot;:&quot;\u003cstring\u003e&quot;,&quot;archive_comment_timestamp&quot;:&quot;\u003clong\u003e&quot;,&quot;archive_comment_user&quot;:{&quot;uuid&quot;:&quot;\u003cstring\u003e&quot;,&quot;handle&quot;:&quot;\u003cstring\u003e&quot;,&quot;icon&quot;:&quot;\u003cstring\u003e&quot;,&quot;id&quot;:&quot;\u003clong\u003e&quot;,&quot;name&quot;:&quot;\u003cstring\u003e&quot;},&quot;archive_reason&quot;:&quot;testing_or_maintenance&quot;,&quot;state_update_timestamp&quot;:&quot;\u003clong\u003e&quot;,&quot;state_update_user&quot;:{&quot;uuid&quot;:&quot;\u003cstring\u003e&quot;,&quot;handle&quot;:&quot;\u003cstring\u003e&quot;,&quot;icon&quot;:&quot;\u003cstring\u003e&quot;,&quot;id&quot;:&quot;\u003clong\u003e&quot;,&quot;name&quot;:&quot;\u003cstring\u003e&quot;}},&quot;id&quot;:&quot;\u003cstring\u003e&quot;,&quot;type&quot;:&quot;signal_metadata&quot;}}