> ## Documentation Index
> Fetch the complete documentation index at: https://docs.calseta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# update_alert_status

> MCP tool to update the triage status of an alert.

## update\_alert\_status

Update an alert's investigation status. Status transitions reflect the investigation lifecycle.

### Parameters

| Parameter              | Type   | Required     | Description                                                                                |
| ---------------------- | ------ | ------------ | ------------------------------------------------------------------------------------------ |
| `alert_uuid`           | string | Yes          | UUID of the alert                                                                          |
| `status`               | string | Yes          | New status: `Open`, `Triaging`, `Escalated`, `Closed`                                      |
| `close_classification` | string | When closing | Classification for closed alerts (e.g., `True Positive`, `False Positive - Known Scanner`) |

### Valid Status Transitions

```
Open → Triaging
Open → Escalated
Open → Closed
Triaging → Escalated
Triaging → Closed
Escalated → Closed
```

### Example

```json theme={null}
{
  "alert_uuid": "9f2a-b3c1-...",
  "status": "Triaging"
}
```

### Return Value

```json theme={null}
{
  "uuid": "9f2a-b3c1-...",
  "status": "Triaging",
  "acknowledged_at": "2025-01-15T10:45:00Z"
}
```

<Info>
  `acknowledged_at` is set automatically on the first transition out of `Open`. It records when investigation began.
</Info>

### Required Scope

`alerts:write`