Change the workflow status of attack discoveries
One step with Elastic Stack. We can help you get access.
Get something done
Change the workflow status of attack discoveries
with Elastic Stack · Threat Detection & Response Management
Use Elastic Stack: its Kibana Security Detections API lets you change the workflow status of attack discoveries in a single step (POST /api/detection_engine/attacks/status). capabilities.work can help you get signed up and connected.
- How do I mark an attack discovery as acknowledged or closed?
- Can closing an attack discovery also close the detection alerts behind it?
Say it to your AI assistant
- Close the attack discovery alerts I've finished investigating.
- Mark these attack discoveries as acknowledged and cascade the status to their related alerts.
For your developer
POST /api/detection_engine/attacks/status in Kibana Security Detections API. Full spec on APIs.io.