Skip to main content
PATCH
Update Alert
Update a single alert, identified by the platform_alert_id you sent when you synced it. Field behavior
  • Omitted field - the current value is kept
  • Field set to null - the value is cleared
  • Field set to a value - the value is updated
status is required on every request. Automatic timestamps
  • Setting assigned_to without assigned_at, or resolved_by without resolved_at, sets the timestamp to the current time.
  • Changing status to under_review sets assigned_at to the current time, unless you send assigned_at.
  • Changing status to closed sets resolved_at to the current time, unless you send resolved_at.
  • Changing status from closed to another status clears resolved_at and resolved_by, unless you send them.
Validation
  • Timestamps more than 5 minutes in the future are rejected.
  • Timestamps must be in order: first_observed_at before last_observed_at, and first_observed_at, detected_at, assigned_at, resolved_at in that order.
Authentication - Requires X-Api-Key header

Authorizations

X-Api-Key
string
header
required

Your Rilevera API key. Contact your administrator to obtain one.

Path Parameters

platform_alert_id
string
required

Unique alert ID from your platform

Body

application/json

Fields to update. Omit a field to keep its current value. Set a field to null to clear it.

status
enum<string>
required

Current status of the alert

Available options:
new,
open,
under_review,
closed
platform_rule_id
string[] | null

Rule ID(s) that triggered this alert. Replaces the existing rule IDs. Send [] to remove all rule IDs; null leaves them unchanged.

source_platform
string | null

Platform where the alert originated

alert_title
string | null

Human-readable alert title

alert_description
string | null

Detailed description of the alert

severity
enum<string> | null

Severity level

Available options:
info,
low,
medium,
high,
critical,
null
detected_at
string<date-time> | null

When the rule detected and triggered this alert

first_observed_at
string<date-time> | null

First time the underlying condition was observed

last_observed_at
string<date-time> | null

Most recent time the condition was seen

tags
string[] | null

Tags associated with the alert. Replaces the existing tags. null clears all tags.

assigned_to
string | null

User assigned to investigate the alert

assigned_at
string<date-time> | null

When the alert was assigned

resolved_by
string | null

User who resolved or closed the alert

resolved_at
string<date-time> | null

When the alert was resolved

resolution_summary
string | null

Summary of findings or resolution

final_disposition
enum<string> | null

Final classification of the alert

Available options:
closed_without_reason,
duplicate,
informational,
false_positive,
benign_positive,
true_positive,
other,
null

Response

Alert updated successfully

platform_alert_id
string

Unique alert ID from your platform

source_platform
string

Platform where the alert originated

detected_at
string<date-time>

When the rule detected and triggered this alert

first_observed_at
string<date-time> | null

First time the underlying condition was observed

last_observed_at
string<date-time> | null

Most recent time the condition was seen

alert_title
string | null

Human-readable alert title

alert_description
string | null

Detailed description of the alert

severity
enum<string> | null

Severity level

Available options:
info,
low,
medium,
high,
critical,
null
status
enum<string> | null

Current status of the alert

Available options:
new,
open,
under_review,
closed,
null
assigned_to
string | null

User assigned to investigate the alert

assigned_at
string<date-time> | null

When the alert was assigned

resolved_by
string | null

User who resolved or closed the alert

resolved_at
string<date-time> | null

When the alert was resolved

resolution_summary
string | null

Summary of findings or resolution

final_disposition
enum<string> | null

Final classification of the alert

Available options:
closed_without_reason,
duplicate,
informational,
false_positive,
benign_positive,
true_positive,
other,
null
tags
string[]

Tags associated with the alert

updated_at
string<date-time> | null

When the alert was last updated

response_metadata
object