Act on alert¶

POST/alerts/{alertId}/actions

Take an action on a specific alert.

Required permissionalerts:action

Parameters¶

Name	In	Type	Required	Description
`X-Tenant-ID`	header	string (uuid)	Yes	Tenant ID.
`alertId`	path	string (uuid)	Yes	Alert ID.

Request body¶

Content type: application/json

Request body fields

actionstringrequired

Actions that you can perform on these alerts.
Must be one of: acknowledge, cleanPua, cleanVirus, authPua, clearThreat, clearHmpa, sendMsgPua, sendMsgThreat.

messagestring

Message to send for the action.

Request samples¶

cURLPythonPowerShellGoJavaScript

curl -X POST "https://api-<data-region>.central.sophos.com/common/v1/alerts/<alertId>/actions" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"action\": \"cleanPua\",
  \"message\": \"Remove WinExeSvc\"
}"

import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/common/v1/alerts/<alertId>/actions",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={'action': 'cleanPua', 'message': 'Remove WinExeSvc'},
)
print(response.json())

$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "action": "cleanPua",
  "message": "Remove WinExeSvc"
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/common/v1/alerts/<alertId>/actions" -Headers $headers -Body $body -ContentType "application/json"

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/common/v1/alerts/<alertId>/actions", strings.NewReader(`{
  "action": "cleanPua",
  "message": "Remove WinExeSvc"
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}

const response = await fetch("https://api-<data-region>.central.sophos.com/common/v1/alerts/<alertId>/actions", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "action": "cleanPua",
  "message": "Remove WinExeSvc"
}),
});
const data = await response.json();
console.log(data);

Responses¶

`201` — Action has been successfully completed for the alert.¶

Response fields

idstring (uuid)required

Alert action ID.

alertIdstring (uuid)required

Alert ID.

actionstringrequired

Actions that you can perform on these alerts.
Must be one of: acknowledge, cleanPua, cleanVirus, authPua, clearThreat, clearHmpa, sendMsgPua, sendMsgThreat.

statusstringrequired

Status of an alert action.
Must be one of: requested, started, completed.

requestedAtstring (datetime)required

Time when the action was requested.

completedAtstring (datetime)

Time when the action was completed.

startedAtstring (datetime)

Time when the action was started.

resultstring

Result of the action.

Errors¶

Status	Meaning
`500`	Unexpected error.

All error responses share the same shape — see the error response object.

Response examples¶

`201`¶

{
  "id": "2f2d0c43-5687-4cf6-ba15-dd1c1173e673",
  "alertId": "f9415c5f-e0e9-41d7-8126-1956223a66f1",
  "action": "cleanPua",
  "status": "started",
  "requestedAt": "2021-02-12T14:35:20.248",
  "startedAt": "2021-02-12T14:37:01.922",
  "completedAt": null,
  "result": ""
}