Skip to main content
POST
Bulk contain multiple assets

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
caseId
string

Case ID for containment context

detectionId
string

Detection ID for containment context

integrationId
string

Integration ID to use for containment. Required for files; optional for endpoints/users (falls back to asset integration).

userContainActions
enum<string>[]

User containment actions to perform

Available options:
disable,
reset_password,
revoke_sessions
endpointContainActions
enum<string>[]

Endpoint containment actions to perform

Available options:
isolate,
lock
userUncontainActions
enum<string>[]

User uncontainment actions to perform

Available options:
enable
endpointUncontainActions
enum<string>[]

Endpoint uncontainment actions to perform

Available options:
unisolate,
unlock
fileContainActions
enum<string>[]

File containment actions to perform

Available options:
delete,
quarantine
fileUncontainActions
enum<string>[]

File uncontainment actions to perform

Available options:
unquarantine
endpointIds
string[]

Array of endpoint IDs to contain

directoryIds
string[]

Array of directory user IDs to contain

fileIds
string[]

Array of file IDs to contain

Response