Update one or more fields of a specific incident. Missing fields are ignored.
Note the following:
- assigned_user_mail field is validated by Cortex XDR to confirm the provided assignee email address belongs to a user that exists in the same Cortex XDR tenant.
- To unassign an incident pass none or ”assigned_user_mail”: “”.
- To remove a manually set severity pass none or “manual_severity”: “”.
curl -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
"https://api-yourfqdn/public_api/v1/incidents/update_incident" \
-d '"{ \n \"request_data\":{ \n \"incident_id\":\"\",\n \"update_data\":{ \n \"assigned_user_mail\":\"username@test.com\",\n \"assigned_user_pretty_name\":\"Hello World\",\n \"manual_severity\":\"low\",\n \"status\":\"resolved_other\",\n \"resolve_comment\":\"This incident is resolved\"\n }\n }"'
{"request_data":{"incident_id":"2927","update_data":{"assigned_user_mail":"username@test.com","assigned_user_pretty_name":"Hello World","manual_severity":"low","status":"resolved_other","resolve_comment":"This incident is resolved"}}}
assigned_user_mail in the same request.
Successful response
Bad Request. Got an invalid JSON.
{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}
Internal server error. A unified status for API communication type errors. For example, test@test.com is not a valid Cortex XDR email address.
{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}