Update Alert

PUT endpoints to update alert status, notes, and tags

Update alert properties including status, notes, and tags.

Update Alert Status

Update the status of one or more alerts.

Request Body

alertIds · array · required

Array of alert IDs to update

status · integer · required

New status code (1=Auto Review, 2=Open, 3=In Progress, 4=Completed, 5=Incident Created)

statusObservation · string

Notes describing the status change

addFalsePositiveTag · boolean · default: "false"

Whether to add a false positive tag (only applicable when status=4)

cURL

curl -X POST https://your-utmstack-instance.com/api/utm-alerts/status \
  -H "Authorization: Bearer eyJhbGciOiJIUzUxMiJ9..." \
  -H "Content-Type: application/json" \
  -d '{
    "alertIds": ["abc123", "def456"],
    "status": 3,
    "statusObservation": "Investigating suspicious activity",
    "addFalsePositiveTag": false
  }'

200 Success

Update Alert Notes

Add or update notes for a specific alert.

Query Parameters

alertId · string · required

The ID of the alert to update

Request Body

Plain text string containing the notes.

cURL

curl -X POST "https://your-utmstack-instance.com/api/utm-alerts/notes?alertId=abc123" \
  -H "Authorization: Bearer eyJhbGciOiJIUzUxMiJ9..." \
  -H "Content-Type: text/plain" \
  -d "User confirmed this was legitimate activity. Closing as false positive."

200 Success

Update Alert Tags

Add or update tags for one or more alerts.

Request Body

alertIds · array · required

Array of alert IDs to tag

tags · array · required

Array of tag names to apply

createRule · boolean · default: "false"

Whether to create an automatic tagging rule based on these tags

cURL

curl -X POST https://your-utmstack-instance.com/api/utm-alerts/tags \
  -H "Authorization: Bearer eyJhbGciOiJIUzUxMiJ9..." \
  -H "Content-Type: application/json" \
  -d '{
    "alertIds": ["abc123", "def456"],
    "tags": ["false-positive", "vpn-access"],
    "createRule": false
  }'

200 Success

Convert to Incident

Convert one or more alerts into an incident for investigation.

Request Body

eventIds · array · required

Array of alert/event IDs to include in the incident

incidentName · string · required

Name for the new incident

incidentId · integer

ID of existing incident to add alerts to (optional)

incidentSource · string

Source/origin of the incident

cURL

curl -X POST https://your-utmstack-instance.com/api/utm-alerts/convert-to-incident \
  -H "Authorization: Bearer eyJhbGciOiJIUzUxMiJ9..." \
  -H "Content-Type: application/json" \
  -d '{
    "eventIds": ["abc123", "def456", "ghi789"],
    "incidentName": "Potential Ransomware Attack",
    "incidentSource": "SOC Analysis"
  }'

200 Success