---
title: "POST /v1beta/projects/{project}/alerts/{alert}:resolve"
method: POST
path: "/v1beta/projects/{project}/alerts/{alert}:resolve"
tags: ["threatintelligence"]
---

# POST /v1beta/projects/{project}/alerts/{alert}:resolve

`POST /v1beta/projects/{project}/alerts/{alert}:resolve`

Marks an alert to closed state - RESOLVED.

## Path parameters

- `project` string, required
- `alert` string, required

## Headers

- `x-goog-user-project` string, required

## Request body

- MarkAlertAsResolvedRequest — Request message for MarkAlertAsResolved.

## Response `default`

Successful operation

- Alert — Stateful object representing a group of Findings. Key feature to an Alert is that it expresses the user's intent towards the findings of that group, even those that haven't occurred yet.
  - `name` string — Identifier. Server generated name for the alert. format is projects/{project}/alerts/{alert}
  - `findings` string[] — Output only. Findings that are covered by this alert.
  - `state` 'STATE_UNSPECIFIED' | 'NEW' | 'READ' | 'TRIAGED' | 'ESCALATED' | 'RESOLVED' | 'DUPLICATE' | 'FALSE_POSITIVE' | 'NOT_ACTIONABLE' | 'BENIGN' | 'TRACKED_EXTERNALLY' — Output only. State of the alert.
  - `audit` Audit — Tracks basic CRUD facts.
    - `updateTime` string, date-time — Output only. Time of creation or last update.
    - `createTime` string, date-time — Output only. Time of creation.
    - `creator` string — Output only. Agent that created or updated the record, could be a UserId or a JobId.
    - `updater` string — Output only. Agent that last updated the record, could be a UserId or a JobId.
  - `displayName` string — Output only. A short title for the alert.
  - `detail` AlertDetail — Container for different types of alert details.
    - `initialAccessBroker` InitialAccessBrokerAlertDetail — Captures the specific details of InitialAccessBroker (IAB) alert.
      - `severity` 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — Required. The severity of the Initial Access Broker (IAB) alert.
      - `discoveryDocumentIds` string[], required — Required. Array of ids to accommodate multiple discovery documents
    - `dataLeak` DataLeakAlertDetail — Captures the specific details of Data Leak alert.
      - `severity` 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — Required. The severity of the Data Leak alert.
      - `discoveryDocumentIds` string[], required — Required. Array of ids to accommodate multiple discovery documents
    - `insiderThreat` InsiderThreatAlertDetail — Captures the specific details of InsiderThreat alert.
      - `severity` 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — Required. The severity of the Insider Threat alert.
      - `discoveryDocumentIds` string[], required — Required. Array of ids to accommodate multiple discovery documents
    - `targetTechnology` TargetTechnologyAlertDetail — Contains details for a technology watchlist alert.
      - `vulnerabilityMatch` VulnerabilityMatch — Contains details about a vulnerability match.
        - `cveId` string, required — Required. The CVE ID of the vulnerability. Ex: "CVE-2025-9876". See https://www.cve.org/ for more information.
        - `collectionId` string, required — Required. The collection ID of the vulnerability. Ex: "vulnerability--cve-2025-9876".
        - `description` string, required — Required. A description of the vulnerability.
        - `technologies` string[], required — Required. All technologies affected by the vulnerability. Ex: "Apache Struts".
        - `cvss3Score` number, float, required — Required. The CVSS score of the vulnerability. Evaluates to CVSS v3 when available with a fallback to v2 and v4. Example: 6.4.
        - `riskRating` 'RISK_RATING_UNSPECIFIED' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' | 'UNRATED', required
        - `exploitationState` 'EXPLOITATION_STATE_UNSPECIFIED' | 'EXPLOITATION_STATE_NO_KNOWN' | 'EXPLOITATION_STATE_REPORTED' | 'EXPLOITATION_STATE_SUSPECTED' | 'EXPLOITATION_STATE_CONFIRMED' | 'EXPLOITATION_STATE_WIDESPREAD', required
        - `associations` VulnerabilityMatchAssociation[] — Optional. Associated threat actors, malware, etc. This is embedded as a snapshot because the details of the association at the time of the vulnerability match are important for context and reporting.
          - `id` string, required — Required. The ID of the association.
          - `type` 'THREAT_INTEL_OBJECT_TYPE_UNSPECIFIED' | 'THREAT_INTEL_OBJECT_TYPE_THREAT_ACTOR' | 'THREAT_INTEL_OBJECT_TYPE_MALWARE' | 'THREAT_INTEL_OBJECT_TYPE_REPORT' | 'THREAT_INTEL_OBJECT_TYPE_CAMPAIGN' | 'THREAT_INTEL_OBJECT_TYPE_IOC_COLLECTION' | 'THREAT_INTEL_OBJECT_TYPE_SOFTWARE_AND_TOOLKITS' | 'THREAT_INTEL_OBJECT_TYPE_VULNERABILITY', required — The type of threat intel object.
        - `epssScore` number, float — Optional. The EPSS score, representing the probability of exploitation. Example: 0.87.
        - `publicExploits` VulnerabilityMatchPublicExploit[] — Optional. List of public exploits.
          - `exploitName` string, required — Required. The name of the exploit. Ex: "Magentounauth.php.txt".
          - `uri` string — Optional. The URI of the exploit.
          - `exploitReliability` 'EXPLOIT_RELIABILITY_UNSPECIFIED' | 'UNREVIEWED' | 'REVIEWED' | 'TESTED' — Represents exploit reliability.
          - `exploitGrade` 'EXPLOIT_GRADE_UNSPECIFIED' | 'UNEVALUATED' | 'PROOF_OF_CONCEPT' | 'NON_WEAPONIZED' | 'WEAPONIZED' | 'SCANNER' | 'FAKE' — Represents exploit grade.
          - `sizeBytes` string, int64 — Optional. The size of the exploit.
          - `releaseTime` string, date-time — Optional. The release time of the exploit.
        - `productFixes` VulnerabilityMatchProductFix[] — Optional. List of product fixes for the vulnerability.
          - `displayName` string, required — Required. The name of the fix. Ex: "Magento".
          - `uri` string — Optional. The URI of the fix.
          - `sourceId` string, required — Required. The source ID of the fix. Ex: "APPSEC-1420".
          - `publishTime` string, date-time — Optional. The published time of the fix.
        - `exploitationConsequences` VulnerabilityMatchExploitationConsequence[] — Optional. List of exploitation consequences for the vulnerability.
        - `exploitationVectors` VulnerabilityMatchExploitationVector[] — Optional. List of exploitation vectors for the vulnerability.
        - `disclosureTime` string, date-time — Optional. The disclosure time of the vulnerability.
        - `priority` 'PRIORITY_UNSPECIFIED' | 'P0' | 'P1' | 'P2' | 'P3' | 'P4'
        - `matchedTechnologies` string[] — Optional. The specific technologies from the configured watchlist that triggered the match. Ex: "Apache Struts".
        - `publiclyAvailableExploit` boolean — Output only. Whether a publicly available exploit exists.
    - `detailType` string — Output only. Name of the detail type. Will be set by the server during creation to the name of the field that is set in the detail union.
  - `duplicateOf` string — Output only. alert name of the alert this alert is a duplicate of. Format: projects/{project}/alerts/{alert}
  - `duplicatedBy` string[] — Output only. alert names of the alerts that are duplicates of this alert. Format: projects/{project}/alerts/{alert}
  - `etag` string — Optional. If included when updating an alert, this should be set to the current etag of the alert. If the etags do not match, the update will be rejected and an ABORTED error will be returned.
  - `externalId` string — Output only. External ID for the alert. This is used internally to provide protection against out of order updates.
  - `aiSummary` string — Optional. AI summary of the alert.
  - `relevanceAnalysis` RelevanceAnalysis — Structured relevance analysis for a threat.
    - `relevant` boolean — Indicates whether the threat is considered relevant.
    - `confidence` 'CONFIDENCE_LEVEL_UNSPECIFIED' | 'CONFIDENCE_LEVEL_LOW' | 'CONFIDENCE_LEVEL_MEDIUM' | 'CONFIDENCE_LEVEL_HIGH'
    - `reasoning` string — Human-readable explanation from the matcher, detailing why a particular result is considered relevant or not relevant.
    - `evidence` Evidence — Details the evidence used to determine the relevance verdict.
      - `commonThemes` string[] — A list of semantic themes or concepts found to be common, related, or aligned between the sources, supporting the verdict.
      - `distinctThemes` string[] — A list of semantic themes or descriptions unique to one source or semantically distant.
    - `relevanceLevel` 'RELEVANCE_LEVEL_UNSPECIFIED' | 'RELEVANCE_LEVEL_LOW' | 'RELEVANCE_LEVEL_MEDIUM' | 'RELEVANCE_LEVEL_HIGH'
  - `severityAnalysis` SeverityAnalysis — Structured severity analysis for a threat.
    - `severityLevel` 'SEVERITY_LEVEL_UNSPECIFIED' | 'SEVERITY_LEVEL_LOW' | 'SEVERITY_LEVEL_MEDIUM' | 'SEVERITY_LEVEL_HIGH'
    - `confidence` 'CONFIDENCE_LEVEL_UNSPECIFIED' | 'CONFIDENCE_LEVEL_LOW' | 'CONFIDENCE_LEVEL_MEDIUM' | 'CONFIDENCE_LEVEL_HIGH'
    - `reasoning` string — Human-readable explanation from the model, detailing why a particular result is considered to have a certain severity.
  - `priorityAnalysis` PriorityAnalysis — Structured priority analysis for a threat.
    - `priorityLevel` 'PRIORITY_LEVEL_UNSPECIFIED' | 'PRIORITY_LEVEL_LOW' | 'PRIORITY_LEVEL_MEDIUM' | 'PRIORITY_LEVEL_HIGH' | 'PRIORITY_LEVEL_CRITICAL'
    - `confidence` 'CONFIDENCE_LEVEL_UNSPECIFIED' | 'CONFIDENCE_LEVEL_LOW' | 'CONFIDENCE_LEVEL_MEDIUM' | 'CONFIDENCE_LEVEL_HIGH'
    - `reasoning` string — Human-readable explanation from the model, detailing why a particular result is considered to have a certain priority.
  - `findingCount` string, int64 — Output only. The number of findings associated with this alert.
  - `configurations` string[] — Output only. The resource names of the Configurations bound to this alert. Format: projects/{project}/configurations/{configuration}

---

[API](https://skmtc.net/virustotal/apis/threat-landscape.md) · [All operations](https://skmtc.net/virustotal/apis/threat-landscape/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/virustotal/threat-landscape/versions/d61b85e6a6b3/schema)