Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Incident → Update
AI-generatedSummary
Update an existing incident by merging provided fields into its record.
Inputs
- incidentId (required) — Unique identifier of the incident to update.
- description — New description text for the incident.
- first_seen — Timestamp of when the incident was first observed.
- last_seen — Timestamp of the most recent observation of the incident.
- name — Human‑readable name of the incident.
- severity — Severity level assigned to the incident.
Output shape
a single Incident object containing all incident fields after the update
The response includes the full updated incident record; fields not provided in updateFields remain unchanged.
Examples
Example 1: Patch the description and severity of incident with ID '12345'.
incidentId: '12345', updateFields: { description: 'Phishing attempt', severity: 'high' }
Example 2: Set first_seen and last_seen dates to capture the incident timeline.
incidentId: '98765', updateFields: { first_seen: '2024-09-01T10:00:00Z', last_seen: '2024-09-02T15:30:00Z' }