Update Alerts

Update an alert or multiple ones. Allows you to update the status, assign it to a user, add comments with additional info, ect.

This endpoint does not support detection IDs prefixed with ldt.

To learn more, visit the CrowdStrike documentation.

Parameters​

Parameter

Description

Action Parameters

A comma-separated list of the parameters for the prospective action.As you work on an alert, you’ll often need to update the status, assign it to a user, or add comments with additional info.In most cases, you must provide both the action name, such as updatestatus, and a value, such as inprogress, in the body of the request. Some actions accept empty values.You can perform these actions on alerts:- add_tag: Add a tag (keyword) to the specified alerts.

• append_comment: Appends a new comment to any existing comments for the specified alerts.

• assign_to_name: Assign the specified alerts to a user based on their username.

• assign_to_user_id: Assign the specified alerts to a user based on their email address.

• assign_to_uuid: Assign the specified alerts to a user based on their UUID.

• remove_tag: Remove a tag from the specified alerts.

• remove_tags_by_prefix: Remove all tags containing a given prefix from the specified alerts.

• show_in_ui: If the value specified is true, display the specified alerts in the Falcon console. Any other value, including an empty value, prevents the specified alerts from appearing in the Falcon console.

• unassign: If there are any users currently assigned to the specified alerts, unassign them.This action doesn’t require a value; if one is specified, the value is ignored.- update_status: Update the status for the specified alerts.Valid statuses are:

  - closed - in_progress - new - reopened | | Alert IDs | Comma separated list of alert IDs to get details on. This endpoint does not support detection IDs prefixed with ldt. |

Example Output​

{    "meta": {        "query_time": 0.209774393,        "writes": {            "resources_affected": 2        },        "powered_by": "detectsapi",        "trace_id": "8326daf7-d03a-4268-a6f9-8e7195a50ec6"    }}

Workflow Library Example​

Update Alerts with Crowdstrike and Send Results Via Email

Preview this Workflow on desktop