Converting an Alert to an Incident
Function
This API is used to convert alerts to incidents.
Calling Method
For details, see Calling APIs.
URI
POST /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/batch-order
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| project_id | Yes | String | Project ID. |
| workspace_id | Yes | String | Workspace ID |
Request Parameters
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| X-Auth-Token | Yes | String | User token. It can be obtained by calling the IAM API used to obtain a user token. The value of X-Subject-Token in the response header is a token. |
| content-type | Yes | String | Content type. |
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| ids | No | Array of strings | IDs of the alerts to be converted into incidents. |
| incident_content | No | incident_content object | Incident details. |
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| title | No | String | Trace |
| incident_type | No | incident_type object | Incident type. |
Response Parameters
Status code: 200
| Parameter | Type | Description |
|---|---|---|
| X-request-id | String | Request ID, in the format request_uuid-timestamp-hostname. |
| Parameter | Type | Description |
|---|---|---|
| code | String | Error code |
| message | String | Error Message |
| data | BatchOperateAlertResult object | Returned object for batch operation on alerts. |
| Parameter | Type | Description |
|---|---|---|
| error_ids | Array of strings | IDs of alerts not transferred to incidents |
| success_ids | Array of strings | IDs of alerts transferred to incidents. |
Status code: 400
| Parameter | Type | Description |
|---|---|---|
| X-request-id | String | Request ID, in the format request_uuid-timestamp-hostname. |
| Parameter | Type | Description |
|---|---|---|
| code | String | Error Code |
| message | String | Error Description |
Example Requests
Convert an alert to an incident, set Alert ID to 909494e3-558e-46b6-a9eb-07a8e18ca62f, Incident ID to 909494e3-558e-46b6-a9eb-07a8e18ca621, Alert status to Closed, and Mark as Evidence to No.
{
"ids" : [ "909494e3-558e-46b6-a9eb-07a8e18ca62f" ],
"incident_content" : {
"title" : "XXX",
"incident_type" : {
"id" : "909494e3-558e-46b6-a9eb-07a8e18ca62f",
"category" : "DDoS attack",
"incident_type" : "DNS protocol attacks"
}
}
} Example Responses
Status code: 200
Response body for converting alerts into incidents.
{
"code" : "909494e3-558e-46b6-a9eb-07a8e18ca62f",
"message" : "Error message",
"data" : {
"error_ids" : [ "909494e3-558e-46b6-a9eb-07a8e18ca62f" ],
"success_ids" : [ "909494e3-558e-46b6-a9eb-07a8e18ca62f" ]
}
} Status Codes
| Status Code | Description |
|---|---|
| 200 | Response body for converting alerts into incidents. |
| 400 | Response body for failures of converting alerts into incidents. |
Error Codes
See Error Codes.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.
