Close Alerts

Change the status of an alert to closed by invoking the following endpoint:

POST https://YourAccount.lacework.net/api/v2/Alerts/{alertId}/close

The body of the request should contain the reason for closing, from these options:

• Other
• False positive
• Not enough information
• Malicious and have resolution in place
• Expected because of routine testing
• Expected behavior

If you choose Other, the message field is required and should contain a brief explanation of why the alert is closed.

Note that a closed alert cannot be reopened.

For details about alert statuses, see Status.