Skip to main content
PATCH
Patch Alert

Path Parameters

alert_uuid
string<uuid>
required

Body

application/json

Patch request for updating an alert — PATCH /v1/alerts/{uuid}. All fields optional. If status=Closed, close_classification is required.

status
enum<string> | null

Alert investigation lifecycle status. Stored as TEXT with Pydantic validation. Do NOT use a Postgres ENUM type — TEXT with app-level validation is easier to migrate.

Transition flow: Open → Triaging / Escalated → Closed

Available options:
Open,
Triaging,
Escalated,
Closed
severity
enum<string> | null

Alert severity levels. Stored as TEXT with Pydantic validation. Source plugins are responsible for mapping source-specific severity values to this enum.

Available options:
Pending,
Informational,
Low,
Medium,
High,
Critical
close_classification
enum<string> | null

Required when status transitions to Closed. Used for FP rate metrics and detection quality. Any value starting with 'False Positive' counts toward the false_positive_rate metric.

Available options:
True Positive - Suspicious Activity,
Benign Positive - Suspicious but Expected,
False Positive - Incorrect Detection Logic,
False Positive - Inaccurate Data,
Undetermined,
Duplicate,
Not Applicable
tags
string[] | null
malice_override
enum<string> | null

Indicator malice verdict — shared validation enum.

Available options:
Pending,
Benign,
Suspicious,
Malicious
reset_malice_override
boolean
default:false

Response

Successful Response

data
AlertResponse · object
required

Full alert response — returned by GET /v1/alerts/{uuid}.

meta
Meta · object