v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Detections API

Assign and unassign users from attack discovery alerts

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/attacks/assignees</span></div>

Refer to Spaces for more information.

Assign users to attack discovery alerts, and unassign them from alerts. Optionally cascade the change to related detection alerts via kibana.alert.attack_discovery.alert_ids.

info You cannot add and remove the same assignee in the same request.

post/api/detection_engine/attacks/assignees

Request body

idsstring[] required

A list of alerts ids.

update_related_alertsboolean

When true, the change is also applied to detection alerts related to the attacks via kibana.alert.attack_discovery.alert_ids.

Response

Successful response

object required

Elasticsearch update by query response