Skip to main content

​
post_alert_finding

Post an investigation finding to an alert. Findings are the agent’s analysis output — conclusions, confidence scores, and recommended actions.

​
Parameters

ParameterTypeRequiredDescription
alert_uuidstringYesUUID of the alert
summarystringYesBrief summary of the finding
confidencefloatNoConfidence score (0.0 to 1.0)
recommended_actionsstring[]NoList of recommended response actions
detailsobjectNoAdditional structured details

​
Example

{
  "alert_uuid": "9f2a-b3c1-...",
  "summary": "Confirmed malicious login from Tor exit node. IP 185.220.101.47 has 14/90 VT detections and 97% AbuseIPDB confidence.",
  "confidence": 0.95,
  "recommended_actions": [
    "Revoke all active sessions for jsmith@company.com",
    "Force password reset",
    "Review recent file access and data exfiltration indicators"
  ],
  "details": {
    "source_ip_analysis": "Known Tor exit node, active in abuse databases",
    "user_risk": "No recent travel, MFA was bypassed via session token"
  }
}

​
Return Value

{
  "uuid": "finding-xyz789-...",
  "alert_uuid": "9f2a-b3c1-...",
  "created_at": "2025-01-15T10:45:00Z"
}

​
Required Scope

alerts:write