Investigate and Close Alert
A 3-step recipe with Varonis. We can help you get access.
Recipe · 3 steps
Investigate and Close Alert
with Varonis · Threat Detection & Response Management
Review a single alert's events, add a findings note, and close it.
- Retrieve the forensic events for the supplied alert id so the analyst can review the activity that triggered the detection.
- Append the investigation findings to the alert as a note so the rationale for closing is preserved in the audit trail.
- Close the alert with the provided close reason to track the resolution pattern.
What you'll need to have ready
- apiKey: Varonis DatAlert API key sent in the X-API-Key header.
- alertId: Unique identifier of the alert to investigate and close.
- note: Investigation findings recorded against the alert.
- closeReason: Reason for closing the alert. One of Resolved, Misconfiguration, Threat model disabled or deleted, Account misclassification, Legitimate activity, or Other.
For your developer
Arazzo workflow varonis:investigate-and-close-alert, 3 operations: getAlertedEvents → addAlertNote → closeAlert. Specs on APIs.io.