Assign and unassign users from detection alerts

Base URL: https://{kibana_url}

POST /api/detection_engine/signals/assignees
POST /s/{space_id}/api/detection_engine/signals/assignees

Auth

Assign users to detection alerts, and unassign them from alerts.

Note

You cannot add and remove the same assignee in the same request.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

User profile IDs to add or remove on each listed alert document ID.

assignees object required
ids string[] · format: nonempty · min items: 1 required: A list of alerts ids.

Responses

Indicates a successful call. The body matches an Elasticsearch update-by-query response (for example took, updated, failures).

application/json

Response Type: object

Invalid input data response

application/json

Unsuccessful authentication response

application/json

Not enough privileges response

application/json

Internal server error response

application/json

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/signals/assignees
{
  "assignees": {
    "add": [
      "u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0"
    ],
    "remove": []
  },
  "ids": [
    "681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6"
  ]
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/signals/assignees" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "assignees": {
      "add": [
        "u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0"
      ],
      "remove": []
    },
    "ids": [
      "681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6"
    ]
  }'

Generated from the API spec

Response

{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 76,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}

{
  "error": "Bad Request",
  "message": "[request body].ids: at least one alert id is required to update assignees",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "error": "Forbidden",
  "message": "API [POST /api/detection_engine/signals/assignees] is unauthorized for the current user, this action is granted by the Kibana Security Solution privileges for cases and detections",
  "statusCode": 403
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/detection_engine/signals/assignees
{
  "assignees": {
    "add": [],
    "remove": [
      "u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0"
    ]
  },
  "ids": [
    "681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6"
  ]
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/detection_engine/signals/assignees" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "assignees": {
      "add": [],
      "remove": [
        "u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0"
      ]
    },
    "ids": [
      "681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6"
    ]
  }'

Generated from the API spec

Response

No example

{
  "error": "Bad Request",
  "message": "[request body].ids: at least one alert id is required to update assignees",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "error": "Forbidden",
  "message": "API [POST /api/detection_engine/signals/assignees] is unauthorized for the current user, this action is granted by the Kibana Security Solution privileges for cases and detections",
  "statusCode": 403
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Path parameters

Request body { }

Responses

Request body