@@ -57909,7 +57909,6 @@ components:
5790957909 - none
5791057910 - false_positive
5791157911 - testing_or_maintenance
57912- - remediated
5791357912 - investigated_case_opened
5791457913 - true_positive_benign
5791557914 - true_positive_malicious
@@ -57919,7 +57918,6 @@ components:
5791957918 - NONE
5792057919 - FALSE_POSITIVE
5792157920 - TESTING_OR_MAINTENANCE
57922- - REMEDIATED
5792357921 - INVESTIGATED_CASE_OPENED
5792457922 - TRUE_POSITIVE_BENIGN
5792557923 - TRUE_POSITIVE_MALICIOUS
@@ -58470,6 +58468,155 @@ components:
5847058468 description: Version of the updated signal. If server side version is higher, update will be rejected.
5847158469 format: int64
5847258470 type: integer
58471+ SecurityMonitoringSignalsBulkAssigneeUpdateAttributes:
58472+ description: Attributes describing the new assignees for a bulk signal update.
58473+ properties:
58474+ assignee:
58475+ description: UUID of the user to assign to the signal. Use an empty string to unassign.
58476+ example: 773b045d-ccf8-4808-bd3b-955ef6a8c940
58477+ type: string
58478+ version:
58479+ $ref: "#/components/schemas/SecurityMonitoringSignalVersion"
58480+ required:
58481+ - assignee
58482+ type: object
58483+ SecurityMonitoringSignalsBulkAssigneeUpdateData:
58484+ description: Data for updating the assignees for multiple security signals.
58485+ properties:
58486+ attributes:
58487+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateAttributes"
58488+ id:
58489+ description: The unique ID of the security signal.
58490+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58491+ type: string
58492+ type:
58493+ $ref: "#/components/schemas/SecurityMonitoringSignalType"
58494+ required:
58495+ - id
58496+ - attributes
58497+ type: object
58498+ SecurityMonitoringSignalsBulkAssigneeUpdateRequest:
58499+ description: Request body for updating the assignee of multiple security signals.
58500+ properties:
58501+ data:
58502+ description: An array of signal assignee updates.
58503+ items:
58504+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateData"
58505+ maxItems: 199
58506+ type: array
58507+ required:
58508+ - data
58509+ type: object
58510+ SecurityMonitoringSignalsBulkStateUpdateData:
58511+ description: Data for updating the state for multiple security signals.
58512+ properties:
58513+ attributes:
58514+ $ref: "#/components/schemas/SecurityMonitoringSignalStateUpdateAttributes"
58515+ id:
58516+ description: The unique ID of the security signal.
58517+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58518+ type: string
58519+ type:
58520+ $ref: "#/components/schemas/SecurityMonitoringSignalType"
58521+ required:
58522+ - id
58523+ - attributes
58524+ type: object
58525+ SecurityMonitoringSignalsBulkStateUpdateRequest:
58526+ description: Request body for updating the triage states of multiple security signals.
58527+ properties:
58528+ data:
58529+ description: An array of signal state updates.
58530+ items:
58531+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkStateUpdateData"
58532+ maxItems: 199
58533+ type: array
58534+ required:
58535+ - data
58536+ type: object
58537+ SecurityMonitoringSignalsBulkTriageEvent:
58538+ description: A single signal event entry in a bulk triage update response.
58539+ properties:
58540+ event:
58541+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageEventAttributes"
58542+ id:
58543+ description: The unique ID of the security signal.
58544+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58545+ type: string
58546+ required:
58547+ - id
58548+ - event
58549+ type: object
58550+ SecurityMonitoringSignalsBulkTriageEventAttributes:
58551+ description: Triage attributes of a security signal returned in a bulk update response.
58552+ properties:
58553+ archive_comment:
58554+ $ref: "#/components/schemas/SecurityMonitoringSignalArchiveComment"
58555+ archive_comment_timestamp:
58556+ description: Timestamp of the last edit to the archive comment.
58557+ format: int64
58558+ type: integer
58559+ archive_comment_user:
58560+ $ref: "#/components/schemas/SecurityMonitoringTriageUser"
58561+ archive_reason:
58562+ $ref: "#/components/schemas/SecurityMonitoringSignalArchiveReason"
58563+ assignee:
58564+ $ref: "#/components/schemas/SecurityMonitoringTriageUser"
58565+ id:
58566+ description: The unique ID of the security signal.
58567+ example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA
58568+ type: string
58569+ incident_ids:
58570+ $ref: "#/components/schemas/SecurityMonitoringSignalIncidentIds"
58571+ state:
58572+ $ref: "#/components/schemas/SecurityMonitoringSignalState"
58573+ state_update_timestamp:
58574+ description: Timestamp of the last state update.
58575+ format: int64
58576+ type: integer
58577+ state_update_user:
58578+ $ref: "#/components/schemas/SecurityMonitoringTriageUser"
58579+ required:
58580+ - id
58581+ - state
58582+ - assignee
58583+ - incident_ids
58584+ type: object
58585+ SecurityMonitoringSignalsBulkTriageUpdateResponse:
58586+ description: Response for a bulk triage update of security signals.
58587+ properties:
58588+ result:
58589+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResult"
58590+ status:
58591+ description: The status of the bulk operation.
58592+ example: done
58593+ type: string
58594+ type:
58595+ description: The type of the response.
58596+ example: status
58597+ type: string
58598+ required:
58599+ - type
58600+ - status
58601+ - result
58602+ type: object
58603+ SecurityMonitoringSignalsBulkTriageUpdateResult:
58604+ description: The result payload of a bulk signal triage update.
58605+ properties:
58606+ count:
58607+ description: The number of signals updated.
58608+ example: 2
58609+ format: int64
58610+ type: integer
58611+ events:
58612+ description: The list of updated signals.
58613+ items:
58614+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageEvent"
58615+ type: array
58616+ required:
58617+ - count
58618+ - events
58619+ type: object
5847358620 SecurityMonitoringSignalsListResponse:
5847458621 description: "The response object with all security signals matching the request\nand pagination information."
5847558622 properties:
@@ -102393,6 +102540,88 @@ paths:
102393102540 operator: OR
102394102541 permissions:
102395102542 - security_monitoring_signals_read
102543+ /api/v2/security_monitoring/signals/bulk/assignee:
102544+ patch:
102545+ description: |-
102546+ Change the triage assignees of multiple security signals at once.
102547+ The maximum number of signals that can be updated in a single request is 199.
102548+ operationId: BulkEditSecurityMonitoringSignalsAssignee
102549+ requestBody:
102550+ content:
102551+ application/json:
102552+ schema:
102553+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateRequest"
102554+ description: Attributes describing the signal assignee updates.
102555+ required: true
102556+ responses:
102557+ "200":
102558+ content:
102559+ application/json:
102560+ schema:
102561+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse"
102562+ description: OK
102563+ "400":
102564+ content:
102565+ application/json:
102566+ schema:
102567+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102568+ description: Bad Request
102569+ "403":
102570+ content:
102571+ application/json:
102572+ schema:
102573+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102574+ description: Forbidden
102575+ "429":
102576+ $ref: "#/components/responses/TooManyRequestsResponse"
102577+ summary: Bulk update triage assignee of security signals
102578+ tags: ["Security Monitoring"]
102579+ x-codegen-request-body-name: body
102580+ "x-permission":
102581+ operator: OR
102582+ permissions:
102583+ - security_monitoring_signals_write
102584+ /api/v2/security_monitoring/signals/bulk/state:
102585+ patch:
102586+ description: |-
102587+ Change the triage states of multiple security signals at once.
102588+ The maximum number of signals that can be updated in a single request is 199.
102589+ operationId: BulkEditSecurityMonitoringSignalsState
102590+ requestBody:
102591+ content:
102592+ application/json:
102593+ schema:
102594+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkStateUpdateRequest"
102595+ description: Attributes describing the signal state updates.
102596+ required: true
102597+ responses:
102598+ "200":
102599+ content:
102600+ application/json:
102601+ schema:
102602+ $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse"
102603+ description: OK
102604+ "400":
102605+ content:
102606+ application/json:
102607+ schema:
102608+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102609+ description: Bad Request
102610+ "403":
102611+ content:
102612+ application/json:
102613+ schema:
102614+ $ref: "#/components/schemas/JSONAPIErrorResponse"
102615+ description: Forbidden
102616+ "429":
102617+ $ref: "#/components/responses/TooManyRequestsResponse"
102618+ summary: Bulk update triage state of security signals
102619+ tags: ["Security Monitoring"]
102620+ x-codegen-request-body-name: body
102621+ "x-permission":
102622+ operator: OR
102623+ permissions:
102624+ - security_monitoring_signals_write
102396102625 /api/v2/security_monitoring/signals/search:
102397102626 post:
102398102627 description: |-
@@ -102449,8 +102678,6 @@ paths:
102449102678 schema:
102450102679 $ref: "#/components/schemas/SecurityMonitoringSignalResponse"
102451102680 description: OK
102452- "403":
102453- $ref: "#/components/responses/NotAuthorizedResponse"
102454102681 "404":
102455102682 $ref: "#/components/responses/NotFoundResponse"
102456102683 "429":
@@ -102488,17 +102715,25 @@ paths:
102488102715 $ref: "#/components/schemas/SecurityMonitoringSignalTriageUpdateResponse"
102489102716 description: OK
102490102717 "400":
102491- $ref: "#/components/responses/BadRequestResponse"
102718+ content:
102719+ application/json:
102720+ schema:
102721+ $ref: "#/components/schemas/APIErrorResponse"
102722+ description: Bad Request
102492102723 "403":
102493- $ref: "#/components/responses/NotAuthorizedResponse"
102724+ content:
102725+ application/json:
102726+ schema:
102727+ $ref: "#/components/schemas/APIErrorResponse"
102728+ description: Forbidden
102494102729 "404":
102495- $ref: "#/components/responses/NotFoundResponse"
102730+ content:
102731+ application/json:
102732+ schema:
102733+ $ref: "#/components/schemas/APIErrorResponse"
102734+ description: Not Found
102496102735 "429":
102497102736 $ref: "#/components/responses/TooManyRequestsResponse"
102498- security:
102499- - apiKeyAuth: []
102500- appKeyAuth: []
102501- - AuthZ: []
102502102737 summary: Modify the triage assignee of a security signal
102503102738 tags: ["Security Monitoring"]
102504102739 x-codegen-request-body-name: body
@@ -102528,17 +102763,25 @@ paths:
102528102763 $ref: "#/components/schemas/SecurityMonitoringSignalTriageUpdateResponse"
102529102764 description: OK
102530102765 "400":
102531- $ref: "#/components/responses/BadRequestResponse"
102766+ content:
102767+ application/json:
102768+ schema:
102769+ $ref: "#/components/schemas/APIErrorResponse"
102770+ description: Bad Request
102532102771 "403":
102533- $ref: "#/components/responses/NotAuthorizedResponse"
102772+ content:
102773+ application/json:
102774+ schema:
102775+ $ref: "#/components/schemas/APIErrorResponse"
102776+ description: Forbidden
102534102777 "404":
102535- $ref: "#/components/responses/NotFoundResponse"
102778+ content:
102779+ application/json:
102780+ schema:
102781+ $ref: "#/components/schemas/APIErrorResponse"
102782+ description: Not Found
102536102783 "429":
102537102784 $ref: "#/components/responses/TooManyRequestsResponse"
102538- security:
102539- - apiKeyAuth: []
102540- appKeyAuth: []
102541- - AuthZ: []
102542102785 summary: Change the related incidents of a security signal
102543102786 tags: ["Security Monitoring"]
102544102787 x-codegen-request-body-name: body
@@ -102568,17 +102811,25 @@ paths:
102568102811 $ref: "#/components/schemas/SecurityMonitoringSignalTriageUpdateResponse"
102569102812 description: OK
102570102813 "400":
102571- $ref: "#/components/responses/BadRequestResponse"
102814+ content:
102815+ application/json:
102816+ schema:
102817+ $ref: "#/components/schemas/APIErrorResponse"
102818+ description: Bad Request
102572102819 "403":
102573- $ref: "#/components/responses/NotAuthorizedResponse"
102820+ content:
102821+ application/json:
102822+ schema:
102823+ $ref: "#/components/schemas/APIErrorResponse"
102824+ description: Forbidden
102574102825 "404":
102575- $ref: "#/components/responses/NotFoundResponse"
102826+ content:
102827+ application/json:
102828+ schema:
102829+ $ref: "#/components/schemas/APIErrorResponse"
102830+ description: Not Found
102576102831 "429":
102577102832 $ref: "#/components/responses/TooManyRequestsResponse"
102578- security:
102579- - apiKeyAuth: []
102580- appKeyAuth: []
102581- - AuthZ: []
102582102833 summary: Change the triage state of a security signal
102583102834 tags: ["Security Monitoring"]
102584102835 x-codegen-request-body-name: body
0 commit comments