Status

APIs for updating report status

Update report status

post

Updates the status of an MTH/MDR report.

Validation rules:

• xsoar_source_id is required. It accepts a string or an array of strings; when an array is supplied only the first element is used and the rest are silently ignored.
• report_status is required and must be one of the supported display values: New, In Progress, On Hold, Resolved False Positive, Resolved True Positive, Resolved Other, Resolved Security Testing. The value is converted to its internal name before being stored.
• If the report cannot be found, a generic error response is returned.

Response notes:

• Returns the updated report in the UPPER_SNAKE_CASE shape (ReportUpperCase).
• COMMENTS is always null on this response — this endpoint reloads the report without its joined comments. Use get_all_reports, get_reports_by_statuses, or get_reports_by_incident_id to retrieve comments.
• ATTACHMENTS is null on this response for the same reason.
• REPORT_STATUS is the internal name (for example IN_PROGRESS), not the display value that was sent in the request.

Required licenses: MDR, MTH, Managed XSIAM Pro, Managed XSIAM Premium.

Permissions: Users with Instance Administrator privileges only can access these endpoints.

Authorizations

AuthorizationstringRequired

API Key for authentication

x-xdr-auth-idstringRequired

API Key ID for authentication

Header parameters

AuthorizationstringRequired

{api_key}

Example: YOUR_API_KEY_HERE

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

request_dataobjectOptional

Request data wrapper

Responses

200

Successful Response

application/json

Response for the status-update and assignment-update endpoints. reply.COMMENTS and reply.ATTACHMENTS are always null here.

400

Bad Request - Invalid parameters or missing required fields

application/json

401

Unauthorized - Invalid or missing API key

application/json

403

Forbidden - Tenant not authorized for this endpoint, or the caller lacks Instance Administrator privileges

application/json

500

Internal Server Error.

Note: most business-logic and input-validation failures on these endpoints are also returned with HTTP 500 and reply.err_code 500, with the specific reason in reply.err_extra. Do not rely on a 400 status to detect a bad request; inspect reply.err_extra.

application/json

post/public_api/v1/mth/child/report/update/status

POST /public_api/v1/mth/child/report/update/status HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY_HERE
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 75

{
  "request_data": {
    "xsoar_source_id": "777776",
    "report_status": "In Progress"
  }
}

{
  "reply": {
    "XSOAR_SOURCE_ID": "777771",
    "NAME": "Updated Report 5",
    "DESCRIPTION": "Updated description",
    "CREATED_BY": "Unit42 Threat Hunting",
    "INSERT_TIME": 1763468832000,
    "UPDATE_TIME": 1765983782000,
    "ATTACHMENTS": null,
    "INCIDENT_ID": 1,
    "REPORT_TYPE": "Threat Report Update",
    "SEVERITY": "SEV_040_HIGH",
    "COMMENTS": null,
    "CLASSIFICATION": "MTH",
    "ASSIGNED_USER": "[e-mail]",
    "ASSIGNED_USER_PRETTY": "iavron iavron",
    "REPORT_STATUS": "IN_PROGRESS",
    "xsoar_source_id": "777771",
    "report_type": "Threat Report Update",
    "insert_time": 1763468832000,
    "name": "Updated Report 5",
    "description": "Updated description",
    "incident_id": 1,
    "update_time": 1765983782000,
    "severity": "SEV_040_HIGH",
    "attachments": "{}",
    "classification": "MTH",
    "assigned_user": "[e-mail]",
    "report_status": "ON_HOLD",
    "assigned_user_pretty": "iavron iavron"
  }
}