Sign in

v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB
Query

Acknowledge Alerts

Acknowledges the alert event(s) matching the given query. Note that this will not remove the event from connected SOC users' Alert screens when the same alert event happens to be also present on their Alert screen. However, if they refresh the Alert screen the alert event will no longer be listed.

post/connect/events/ack

Request body

acknowledgeboolean

Whether to acknowledge or unacknowledge the events: true = acknowledge, false = unacknowledge

dateRangestring

The date range to use for searching for matching events

dateRangeFormatstring

The date range format. If unsure how to use this then use the example value exactly as shown.

escalateboolean

Whether the events have also been escalated to a case: true = escalated, false = has not been escalated

eventFilterobject

Optional event filters to further narrow down matching events to acknowledge. These are field:value pairs.

searchFilterstring

The search filter to utilize when searching for matching events to acknowledge.

timezonestring

The timezone to use with the date range

Example request

{
  "acknowledge": true,
  "dateRange": "2024/12/03 02:31:35 PM - 2024/12/04 02:31:35 PM",
  "dateRangeFormat": "2006/01/02 3:04:05 PM",
  "eventFilter": {
    "event.module": "sigma",
    "rule.name": "Security Onion - SOC Login Failure",
    "rule.uuid": "bf86ef21-41e6-417b-9a05-b9ea6bf28a38"
  },
  "searchFilter": "tags:alert AND NOT event.acknowledged:true AND NOT event.escalated:true | groupby rule.name event.module* event.severity_label rule.uuid",
  "timezone": "America/New_York"
}

Response

Outputs the list of update results

completeTimestring

The date and time when the search completed

createTimestring

The date and time when the search was submitted

elapsedMsinteger

The number of milliseconds it took to complete the search

errorsstring[]

A list of errors that the search encountered. The presence of errors does not necessarily preclude the search from returning events."

unchangedCountinteger

The number of events the were left unmodified

updatedCountinteger

The number of events that were updated

Example response

{
  "completeTime": "2024-12-04T19:54:33.822293482Z",
  "createTime": "2024-12-04T19:54:33.519514906Z",
  "criteria": {
    "beginTime": "2024-12-03T14:31:35-05:00",
    "createTime": "2024-12-04T19:31:42.73865332Z",
    "endTime": "2024-12-04T14:31:35-05:00",
    "eventLimit": 100,
    "metricLimit": 10,
    "query": "(*) AND tags:alert AND NOT event.acknowledged:true AND NOT event.escalated:true | groupby rule.name event.module* event.severity_label rule.uuid",
    "updateScripts": [
      "<Painless Script Syntax>"
    ]
  },
  "elapsedMs": 299,
  "errors": [
    "all shards failed"
  ],
  "updatedCount": 1
}