Set a detection alert status

Base URL: https://{kibana_url}

POST /api/detection_engine/signals/status
POST /s/{space_id}/api/detection_engine/signals/status

Auth

Set the status of one or more detection alerts.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

An object containing desired status and explicit alert ids or a query to select alerts

One of:

status: closed

status enum required: Values: closed
reason union oneOf: The reason for closing the alerts. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user through the advanced settings.; Values: false_positive duplicate true_positive benign_positive automated_closure other
signal_ids string[] · format: nonempty · min items: 1 required: List of alert ids. Use field _id on alert document or kibana.alert.uuid. Note: signals are a deprecated term for alerts.

One of:

status: closed

status enum required: Values: closed
conflicts enum · default: abort: Values: abort proceed
query object required
reason union oneOf: The reason for closing the alerts. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user through the advanced settings.; Values: false_positive duplicate true_positive benign_positive automated_closure other
runtime_fields map string to enum · max properties: 100: Optional map of field name to runtime field type. For each entry, the server defines a runtime field of the given type that reads its value from _source[fieldName] and attaches it to the underlying _update_by_query as runtime_mappings. Allows the query to reference non-ECS fields stored on the alert _source but not in the alerts index mapping — for example, runtime fields the rule's source index defined at the time the alerts were created. Limited to 100 entries per request; larger maps are rejected.
runtime_mappings map string to object · max properties: 100: Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script. Kibana sends type, script.source, and format to Elasticsearch as runtime_mappings on the status-update query. Unlike runtime_fields, Kibana keeps your script and runs it at query time. It does not replace the script with a _source reader. When a script is present, Kibana sets on_script_error to continue. If the script fails on one alert, that field has no value for the alert and the update continues. Unique field names across runtime_fields and runtime_mappings combined cannot exceed 100. Larger maps are rejected.

status: open | acknowledged | in-progress

status enum required: The status of an alert, which can be open, acknowledged, in-progress, or closed.; Values: open acknowledged in-progress
conflicts enum · default: abort: Values: abort proceed
query object required
runtime_fields map string to enum · max properties: 100: Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from _source[fieldName] and included in the query as runtime_mappings. Use this to reference fields stored on the alert _source that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.
runtime_mappings map string to object · max properties: 100: Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script. Kibana sends type, script.source, and format to Elasticsearch as runtime_mappings on the status-update query. Unlike runtime_fields, Kibana keeps your script and runs it at query time. It does not replace the script with a _source reader. When a script is present, Kibana sets on_script_error to continue. If the script fails on one alert, that field has no value for the alert and the update continues. Unique field names across runtime_fields and runtime_mappings combined cannot exceed 100. Larger maps are rejected.

Responses

Successful response

application/json

Response Type: object

Invalid input data response

application/json

Unsuccessful authentication response

application/json

Internal server error response

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/signals/status
{
  "signal_ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "status": "closed"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/signals/status" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "signal_ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "status": "closed"
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 81,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "error": "Bad Request",
  "message": "[request body].signal_ids: at least one alert id is required to update status",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/signals/status
{
  "conflicts": "proceed",
  "query": {
    "bool": {
      "filter": [
        {
          "@timestamp": {
            "format": "strict_date_optional_time",
            "gte": "2024-10-23T07:00:00.000Z",
            "lte": "2025-01-21T20:12:11.704Z"
          },
          "range": "null"
        },
        {
          "bool": {
            "filter": {
              "bool": {
                "filter": [
                  {
                    "match_phrase": {
                      "kibana.alert.workflow_status": "open"
                    }
                  },
                  {
                    "@timestamp": {
                      "format": "strict_date_optional_time",
                      "gte": "2024-10-23T07:00:00.000Z",
                      "lte": "2025-01-21T20:12:11.704Z"
                    },
                    "range": "null"
                  }
                ],
                "must": [],
                "must_not": [
                  {
                    "exists": {
                      "field": "kibana.alert.building_block_type"
                    }
                  }
                ],
                "should": []
              }
            }
          }
        }
      ],
      "must": [],
      "must_not": [],
      "should": []
    }
  },
  "status": "closed"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/signals/status" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "conflicts": "proceed",
    "query": {
      "bool": {
        "filter": [
          {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2024-10-23T07:00:00.000Z",
              "lte": "2025-01-21T20:12:11.704Z"
            },
            "range": "null"
          },
          {
            "bool": {
              "filter": {
                "bool": {
                  "filter": [
                    {
                      "match_phrase": {
                        "kibana.alert.workflow_status": "open"
                      }
                    },
                    {
                      "@timestamp": {
                        "format": "strict_date_optional_time",
                        "gte": "2024-10-23T07:00:00.000Z",
                        "lte": "2025-01-21T20:12:11.704Z"
                      },
                      "range": "null"
                    }
                  ],
                  "must": [],
                  "must_not": [
                    {
                      "exists": {
                        "field": "kibana.alert.building_block_type"
                      }
                    }
                  ],
                  "should": []
                }
              }
            }
          }
        ],
        "must": [],
        "must_not": [],
        "should": []
      }
    },
    "status": "closed"
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 100,
  "total": 17,
  "updated": 17,
  "version_conflicts": 0
}

{
  "error": "Bad Request",
  "message": "[request body].signal_ids: at least one alert id is required to update status",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "message": "Internal Server Error",
  "status_code": 500
}