---
title: "Create or update an indicator triage state"
method: POST
path: "/api/v2/security/siem/ioc-explorer/triage"
tags: ["Security Monitoring"]
---

# Create or update an indicator triage state

`POST /api/v2/security/siem/ioc-explorer/triage`

Set the triage state of an indicator of compromise (IoC). This creates or
updates the triage state for the indicator in your organization.

## Request body

- IoCTriageWriteRequest — Request body for creating or updating an indicator triage state.
  - `data` IoCTriageWriteRequestData, required — Data object for the triage write request.
    - `attributes` IoCTriageWriteRequestAttributes, required — Attributes for setting an indicator's triage state.
      - `indicator` string, required — The indicator value to triage (for example, an IP address or domain).
      - `triage_state` 'not_reviewed' | 'reviewed', required — Current triage state of the indicator.
    - `type` string, required — Triage state resource type.

## Response `201`

Created

- IoCTriageWriteResponse — Response for the create indicator triage state endpoint.
  - `data` IoCTriageWriteResponseData — Data object of the triage write response.
    - `attributes` IoCTriageWriteResponseAttributes — Attributes of a created or updated triage state.
      - `created_at` string, date-time — Timestamp when the triage record was created.
      - `indicator` string — The indicator value that was triaged.
      - `triage_state` 'not_reviewed' | 'reviewed' — Current triage state of the indicator.
      - `triaged_at` string, date-time — Timestamp when the triage state was set.
      - `triaged_by` string — UUID of the user who set the triage state.
    - `id` string — Unique identifier for the triage state record.
    - `type` string — Triage state resource type.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)