Status

APIs for updating report status

Update report status

post

Updates the status of an MTH/MDR report.

Validation rules:

• xsoar_source_id is required. It accepts a string or an array of strings; when an array is supplied only the first element is used and the rest are silently ignored.
• report_status is required and must be one of the supported display values: New, In Progress, On Hold, Resolved False Positive, Resolved True Positive, Resolved Other, Resolved Security Testing. The value is converted to its internal name before being stored.
• If the report cannot be found, a generic error response is returned.

Response notes:

• Returns the updated report in the UPPER_SNAKE_CASE shape (ReportUpperCase).
• COMMENTS is always null on this response — this endpoint reloads the report without its joined comments. Use get_all_reports, get_reports_by_statuses, or get_reports_by_incident_id to retrieve comments.
• ATTACHMENTS is null on this response for the same reason.
• REPORT_STATUS is the internal name (for example IN_PROGRESS), not the display value that was sent in the request.

Required licenses: MDR, MTH, Managed XSIAM Pro, Managed XSIAM Premium.

Permissions: Users with Instance Administrator privileges only can access these endpoints.

Authorizations

AuthorizationstringRequired

API Key for authentication

x-xdr-auth-idstringRequired

API Key ID for authentication

Header parameters

AuthorizationstringRequired

{api_key}

Example: YOUR_API_KEY_HERE

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

xsoar_source_idone ofRequired

XSOAR source ID of the report to update. Accepts a string or an array of strings; only the first element of an array is used.

stringOptional

or

string[]Optional

report_statusstring · enumRequired

Report status, expressed as its display value. Used in request payloads.

Possible values:

Responses

200

Successful Response

application/json

Response for the status-update and assignment-update endpoints. reply.COMMENTS and reply.ATTACHMENTS are always null here.

400

Bad Request - Invalid parameters or missing required fields

application/json

401

Unauthorized - Invalid or missing API key

application/json

403

Forbidden - Tenant not authorized for this endpoint, or the caller lacks Instance Administrator privileges

application/json

500

Internal Server Error.

Note: most business-logic and input-validation failures on these endpoints are also returned with HTTP 500 and reply.err_code 500, with the specific reason in reply.err_extra. Do not rely on a 400 status to detect a bad request; inspect reply.err_extra.

application/json

post/public_api/v1/mth/child/report/update/status

POST /public_api/v1/mth/child/report/update/status HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY_HERE
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 58

{
  "xsoar_source_id": "777776",
  "report_status": "In Progress"
}

{
  "reply": {
    "XSOAR_SOURCE_ID": "777771",
    "NAME": "Updated Report 5",
    "DESCRIPTION": "Updated description",
    "CREATED_BY": "Unit42 Threat Hunting",
    "INSERT_TIME": 1763468832000,
    "UPDATE_TIME": 1765983782000,
    "ATTACHMENTS": null,
    "INCIDENT_ID": 1,
    "REPORT_TYPE": "Threat Report Update",
    "SEVERITY": "SEV_040_HIGH",
    "COMMENTS": null,
    "CLASSIFICATION": "MTH",
    "ASSIGNED_USER": "[e-mail]",
    "ASSIGNED_USER_PRETTY": "iavron iavron",
    "REPORT_STATUS": "IN_PROGRESS"
  }
}