Assign and unassign users from detection alerts

POST /api/detection_engine/signals/assignees
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/detection_engine/signals/assignees

Refer to Spaces for more information.

Assign users to detection alerts, and unassign them from alerts.

You cannot add and remove the same assignee in the same request.

application/json

Body Required

  • assignees object Required
    Hide assignees attributes Show assignees attributes object
    • add array[string(nonempty)] Required

      A list of user profile uids to assign. Users need to activate their user profile by logging into Kibana at least once.

      Minimum length of each is 1.

    • remove array[string(nonempty)] Required

      A list of user profile uids to unassign. Users need to activate their user profile by logging into Kibana at least once.

      Minimum length of each is 1.

  • ids array[string(nonempty)] Required

    A list of alerts ids.

    At least 1 element. Minimum length of each is 1.

Responses

  • 200

    Indicates a successful call.

  • 400

    Invalid request.

POST /api/detection_engine/signals/assignees 
curl \
 --request POST 'https://localhost:5601/api/detection_engine/signals/assignees' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"assignees":{"add":["string"],"remove":["string"]},"ids":["string"]}'