Resolve detections

Overview¶

Use Mutation.detectionUpdateResolutionInfo to add or update resolution information for a list of detections.

The mutation accepts detection IDs, a resolution status, and an optional reason. The response reports whether the operation succeeded.

Resolve detections by ID¶

mutation ResolveDetections($in: UpdateResolutionRequestInput) {
  detectionUpdateResolutionInfo(in: $in) {
    reason
    resolution_status
  }
}

{
  "variables": {
    "in": {
      "alert_ids": ["<detection-id-1>", "<detection-id-2>"],
      "resolution_status": "FALSE_POSITIVE",
      "reason": "Confirmed benign activity"
    }
  }
}

The schema retains alert_ids as the input field name. Pass detection IDs in that field.

Check the generated UpdateResolutionRequestInput reference for the supported resolution statuses and optional audit fields.

Resolve detections from a search¶

Use Subscription.detectionBulkResolutionProcessor when a QL expression selects the detections to resolve. The generated reference documents query and mutation operations. See the Detections GraphQL API reference for the published API surface.

subscription BulkResolveDetections($in: BulkResolutionRequestInput) {
  detectionBulkResolutionProcessor(in: $in) {
    resolution_status
    reason
  }
}

{
  "variables": {
    "in": {
      "query": "from alert where status = 'OPEN' and severity < 0.4 earliest=-1h",
      "resolution_status": "FALSE_POSITIVE",
      "reason": "Reviewed as benign"
    }
  }
}

Review the QL query before you submit a bulk operation. A broad query can update more detections than you expect.

Verify the result¶

Check resolution_status in the response. A failed operation returns a failed response status and a reason. A GraphQL validation failure can still return HTTP 200 with an errors array, so handle both response forms.

For detection fields such as current status and resolution history, see the Detections GraphQL API reference.