You can use the alert acknowledgment request to confirm that you have reviewed the alert so that it is no longer listed in the Web UI. To acknowledge a single alert, send the following HTTP POST request URL, headers, and body:
POST https://<cm_address>/wsapis/v1.2.0/alerts/alert/[<alert_ID>|<UUID>]
POST https://<cm_address>/wsapis/v2.0.0/alerts/alert/<UUID>
Availability
This command is available on the following appliances:
Central Management System
Required headers:
X-FeApi-Token: [API-Token] X-FeClient-Token: [Client-Token] Accept: application/json Content-Type: application/json
Body:
annotation: [Annotation] alertType: [Alert-Type]
Parameters
cm_address—The IP address of the Central Management System appliance running the Web Services API.alert_ID— (v1.2.0 only) The infection ID. You must also specify the Alert-Type.UUID—The universally unique identifier (UUID) for the alert.schema_compatibility—(v2.0.0 only) Produce XML and JSON content compatible with the upgraded schema.trueis the only accepted value. Omit this option if you are using an older schema and do not want schema compatibility. If using this option, you must use UUID for the alert.API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
Client-Token—(Optional) This client token is provided by Trellix. For more information about the client token, contact your sales representative.
Example request using the infection ID
POST https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/alerts/alert/1234
Request headers:
X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx X-FeClient-Token: BigDataInc Accept: application/json Content-Type: application/json
Body:
{
"annotation" : "<string>"
"alertType" : "<string>"
}Request body fields:
annotation—You must specify a comment, such as "Discovered on December 1".alertType—If you use the infection ID for the alert_ID, you must specify the type of alert, such as"Malware Object".
Example request using the alert UUID
POST https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/alerts/alert/7d9e9883-37e4-4802-a364-08e3fd6efb6a?schema_compatibility=true
Request headers:
X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx X-FeClient-Token: BigDataInc
Body:
{
"annotation" : "Discovered by John Doe"
}Alert acknowledgment response
After the alert acknowledgment request is received, your appliance validates the API token and sends a response code and message.
HTTP/1.1 [Response Code] [Response Message] Date: [Date]
Response fields
Response Code—A standard HTML response code.
200—Request successful.
4xx—Request unsuccessful because unknown or invalid fields were included in the input.
5xx—Request unsuccessful because the server encountered a problem.
Response Message—A standard HTML response message.
Empty—Request successful.
Invalid Client Request—Request unsuccessful because unknown or invalid fields were included in the input.
Server encountered a problem...retry later—Request unsuccessful because the server encountered a problem.
Date—Standard HTML date format.
Example response
HTTP/1.1 200 OK Date: Thu, 23 Nov 2017 13:39:42 GMT