curl --request PATCH \
--url https://api.wirespeed.co/v1/detection/{idOrSid} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"handledCorrectly": true,
"helpfulnessComment": "<string>",
"notes": "<string>"
}
'import requests
url = "https://api.wirespeed.co/v1/detection/{idOrSid}"
payload = {
"handledCorrectly": True,
"helpfulnessComment": "<string>",
"notes": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({handledCorrectly: true, helpfulnessComment: '<string>', notes: '<string>'})
};
fetch('https://api.wirespeed.co/v1/detection/{idOrSid}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.wirespeed.co/v1/detection/{idOrSid}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'handledCorrectly' => true,
'helpfulnessComment' => '<string>',
'notes' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.wirespeed.co/v1/detection/{idOrSid}"
payload := strings.NewReader("{\n \"handledCorrectly\": true,\n \"helpfulnessComment\": \"<string>\",\n \"notes\": \"<string>\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.wirespeed.co/v1/detection/{idOrSid}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"handledCorrectly\": true,\n \"helpfulnessComment\": \"<string>\",\n \"notes\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.wirespeed.co/v1/detection/{idOrSid}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"handledCorrectly\": true,\n \"helpfulnessComment\": \"<string>\",\n \"notes\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"teamId": "<string>",
"status": "NEW",
"createdAt": "<string>",
"containments": [
"USER"
],
"testMode": true,
"sourceIngestedAt": "<string>",
"sourceDetectedAt": "<string>",
"logs": [
{
"log": "<string>",
"timestamp": "<string>",
"debug": true
}
],
"raw": {},
"verdict": "MALICIOUS",
"title": "<string>",
"integrationPlatform": "acronis",
"contained": true,
"reingested": true,
"prevented": true,
"managedByThirdParty": true,
"excludeFromMeans": true,
"sid": "<string>",
"firstRun": true,
"containOnChatOpsFailure": true,
"wasEscalated": true,
"ocsfDetectionFinding": {},
"category": "OTHER__DIAGNOSTIC",
"chatOpsTest": true,
"severity": "INFORMATIONAL",
"severityOrdinal": 123,
"containsVIP": true,
"containsHVA": true,
"excluded": true,
"teamName": "<string>",
"sourceDescription": "<string>",
"notes": "<string>",
"sourceName": "<string>",
"caseId": "<string>",
"verdictedAt": "<string>",
"updatedAt": "<string>",
"closedAt": "<string>",
"refreshRaw": {},
"lastRefreshAt": "<string>",
"helpfulnessRating": "happy",
"integrationId": "<string>",
"duplicateDetectionId": "<string>",
"nextSteps": "<string>",
"caseSid": "<string>",
"escalatedAt": "<string>",
"sourceUrl": "<string>",
"actionSlug": "<string>",
"exclusionId": "<string>",
"exclusionSid": "<string>",
"autoClosed": true,
"autoContained": true,
"verdictSetting": {
"stage": "TRIAGE",
"default": true,
"managedByWspd": true,
"category": "OTHER__DIAGNOSTIC",
"wspdRule": "CLOUD__INVOCATION",
"retired": true,
"escalate": true,
"chatOps": true,
"close": true,
"disabled": true,
"containUserActions": [
"disable"
],
"containEndpointActions": [
"isolate"
],
"containFileActions": [
"delete"
],
"uncontainUserActions": [
"enable"
],
"uncontainEndpointActions": [
"unisolate"
],
"uncontainFileActions": [
"unquarantine"
],
"chatOpsMFA": true,
"monitor": true,
"vipChatOps": true,
"chatOpsUnsureVerdict": "MALICIOUS",
"description": "<string>",
"severity": "INFORMATIONAL",
"id": "<string>",
"monitorFallbackPreset": "ESCALATE",
"createdAt": "<string>",
"updatedAt": "<string>",
"teamId": "<string>",
"chatOpsTimeoutVerdict": "MALICIOUS",
"chatOpsTimeoutMonitor": true,
"chatOpsTimeoutClose": true,
"verdict": "MALICIOUS",
"managedByParent": true,
"useSourceSeverity": true,
"ignoresRemediation": true,
"defaults": "<unknown>"
},
"chatOpsTestEmail": "<string>",
"chatOpsTestPhoneNumber": "<string>",
"customDetectionId": "<string>",
"externalCustomDetectionId": "<string>",
"autoRemediateStartedAt": "<string>",
"remediatedAt": "<string>"
}{
"message": "<string>",
"statusCode": 123
}Update detection details
curl --request PATCH \
--url https://api.wirespeed.co/v1/detection/{idOrSid} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"handledCorrectly": true,
"helpfulnessComment": "<string>",
"notes": "<string>"
}
'import requests
url = "https://api.wirespeed.co/v1/detection/{idOrSid}"
payload = {
"handledCorrectly": True,
"helpfulnessComment": "<string>",
"notes": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({handledCorrectly: true, helpfulnessComment: '<string>', notes: '<string>'})
};
fetch('https://api.wirespeed.co/v1/detection/{idOrSid}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.wirespeed.co/v1/detection/{idOrSid}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'handledCorrectly' => true,
'helpfulnessComment' => '<string>',
'notes' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.wirespeed.co/v1/detection/{idOrSid}"
payload := strings.NewReader("{\n \"handledCorrectly\": true,\n \"helpfulnessComment\": \"<string>\",\n \"notes\": \"<string>\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.wirespeed.co/v1/detection/{idOrSid}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"handledCorrectly\": true,\n \"helpfulnessComment\": \"<string>\",\n \"notes\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.wirespeed.co/v1/detection/{idOrSid}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"handledCorrectly\": true,\n \"helpfulnessComment\": \"<string>\",\n \"notes\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"teamId": "<string>",
"status": "NEW",
"createdAt": "<string>",
"containments": [
"USER"
],
"testMode": true,
"sourceIngestedAt": "<string>",
"sourceDetectedAt": "<string>",
"logs": [
{
"log": "<string>",
"timestamp": "<string>",
"debug": true
}
],
"raw": {},
"verdict": "MALICIOUS",
"title": "<string>",
"integrationPlatform": "acronis",
"contained": true,
"reingested": true,
"prevented": true,
"managedByThirdParty": true,
"excludeFromMeans": true,
"sid": "<string>",
"firstRun": true,
"containOnChatOpsFailure": true,
"wasEscalated": true,
"ocsfDetectionFinding": {},
"category": "OTHER__DIAGNOSTIC",
"chatOpsTest": true,
"severity": "INFORMATIONAL",
"severityOrdinal": 123,
"containsVIP": true,
"containsHVA": true,
"excluded": true,
"teamName": "<string>",
"sourceDescription": "<string>",
"notes": "<string>",
"sourceName": "<string>",
"caseId": "<string>",
"verdictedAt": "<string>",
"updatedAt": "<string>",
"closedAt": "<string>",
"refreshRaw": {},
"lastRefreshAt": "<string>",
"helpfulnessRating": "happy",
"integrationId": "<string>",
"duplicateDetectionId": "<string>",
"nextSteps": "<string>",
"caseSid": "<string>",
"escalatedAt": "<string>",
"sourceUrl": "<string>",
"actionSlug": "<string>",
"exclusionId": "<string>",
"exclusionSid": "<string>",
"autoClosed": true,
"autoContained": true,
"verdictSetting": {
"stage": "TRIAGE",
"default": true,
"managedByWspd": true,
"category": "OTHER__DIAGNOSTIC",
"wspdRule": "CLOUD__INVOCATION",
"retired": true,
"escalate": true,
"chatOps": true,
"close": true,
"disabled": true,
"containUserActions": [
"disable"
],
"containEndpointActions": [
"isolate"
],
"containFileActions": [
"delete"
],
"uncontainUserActions": [
"enable"
],
"uncontainEndpointActions": [
"unisolate"
],
"uncontainFileActions": [
"unquarantine"
],
"chatOpsMFA": true,
"monitor": true,
"vipChatOps": true,
"chatOpsUnsureVerdict": "MALICIOUS",
"description": "<string>",
"severity": "INFORMATIONAL",
"id": "<string>",
"monitorFallbackPreset": "ESCALATE",
"createdAt": "<string>",
"updatedAt": "<string>",
"teamId": "<string>",
"chatOpsTimeoutVerdict": "MALICIOUS",
"chatOpsTimeoutMonitor": true,
"chatOpsTimeoutClose": true,
"verdict": "MALICIOUS",
"managedByParent": true,
"useSourceSeverity": true,
"ignoresRemediation": true,
"defaults": "<unknown>"
},
"chatOpsTestEmail": "<string>",
"chatOpsTestPhoneNumber": "<string>",
"customDetectionId": "<string>",
"externalCustomDetectionId": "<string>",
"autoRemediateStartedAt": "<string>",
"remediatedAt": "<string>"
}{
"message": "<string>",
"statusCode": 123
}Authorizations
Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication.
Path Parameters
Detection ID or SID
Body
New status for the detection
NEW, PROCESSING, ESCALATED, HUNTING, MONITORING, CHATOPS, CLOSED Whether the detection was handled correctly
Verdict assigned to the detection
MALICIOUS, SUSPICIOUS, BENIGN Helpfulness feedback selected while resolving the detection
happy, neutral, unhappy Optional helpfulness feedback comment
Notes or comments about the detection (max 100,000 characters)
Response
Unique identifier for the detection
ID of the team that owns this detection
Current status of the detection
NEW, PROCESSING, ESCALATED, HUNTING, MONITORING, CHATOPS, CLOSED Timestamp when the detection was created
Types of containment actions performed
USER, PROCESS, USER_AGENT, FILE, ENDPOINT, LOCATION, IP, DOMAIN Whether this detection is in test mode
Timestamp when the detection was ingested by Wirespeed
Timestamp when the detection was originally detected by source
Chronological log entries for this detection
Show child attributes
Show child attributes
Raw detection data from the source system
Final verdict assigned to the detection
MALICIOUS, SUSPICIOUS, BENIGN Display title for the detection
Source integration platform that generated this detection
acronis, admin-by-request, agger-labs, anthropic, aws, axonius, bitwarden, box, checkpoint-firewall, checkpoint-harmony, cisco-catalyst, cisco-duo, cisco-meraki, cisco-secure-access, cisco-umbrella, connectwise-psa, crowdstrike-falcon, cyberark, darktrace, dfir-iris, email, exium, fleet-dm, fortianalyzer, fortinet, freshservice, generic-json, generic-syslog, github, google-alert-center, google-chronicle, google-directory, google-security-center, halcyon, halo-itsm, have-i-been-pwned, horizon3, hyas-protect, ipinfo, jamf-pro, jamf-protect, jira-cloud, jira-data-center, jumpcloud, kandji, manage-engine-ad-audit-plus, microsoft, microsoft-entra, microsoft-teams, microsoft-teams-v2, mimecast, netskope, ninjaone, odoo-helpdesk, okta, one-password, onelogin, openai, orca-security, pager-duty, palo-alto-networks-cortex, perception-point, picus, ping-one, reversing-labs, safebreach, sandfly, sentinel-one, service-now, slack, sms, smtp, sonic-wall, sophos, splunk, stairwell, tenable-nessus, thinkst-canary, tracebit, unifi, vectra, watchguard-firebox, windows-event-logs, wirespeed, wiz, wordfence, zabbix, zscaler-zpa Whether containment actions were performed on this detection
Whether this detection was reprocessed after initial ingestion
Whether the detected threat was successfully prevented
Whether this detection is managed by a third-party service (e.g. Falcon Complete)
Whether to exclude this detection from MTTC and other metrics calculations
Short identifier for this detection
Whether this is the first time this detection has been processed
Whether to automatically contain if ChatOps workflow fails
Whether this detection was escalated to external systems
OCSF standardized detection finding data
Security category classification for this detection
OTHER__DIAGNOSTIC, OTHER__INFORMATIONAL_EVENT, OTHER__WARNING, OTHER__UNKNOWN, OTHER__DECEPTION, OTHER__DECEPTION__SIMULATION, OTHER__CUSTOM_DETECTION, CLOUD__INVOCATION, CLOUD__DISCOVERY, CLOUD__DATA_TRANSFER, CLOUD__PERSISTENCE, CLOUD__PUBLIC_BUCKET, ENDPOINT__DISCOVERY, ENDPOINT__EXECUTION, ENDPOINT__LIVE_OFF_THE_LAND, ENDPOINT__NUISANCE, ENDPOINT__MALWARE_DISCOVERY, ENDPOINT__MALWARE_EXECUTION, ENDPOINT__LATE_STAGE, ENDPOINT__PERSISTENCE, ENDPOINT__REMOTE_MANAGEMENT, ENDPOINT__LATERAL_MOVEMENT, ENDPOINT__IMPACT, ENDPOINT__EVASION, ENDPOINT__EXPLOITATION, ENDPOINT__SIMULATION, ENDPOINT__PLANNED_CHANGE, IDENTITY__LOGIN, IDENTITY__REJECTED_MFA, IDENTITY__DISCOVERY, IDENTITY__BRUTE_FORCE, IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE, IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE, IDENTITY__PERSISTENCE, IDENTITY__ACCOUNT_COMPROMISE, IDENTITY__OAUTH_GRANT, IDENTITY__SIMULATION, NETWORK__INBOUND_CONNECTION, NETWORK__OUTBOUND_CONNECTION, NETWORK__PHISHING, NETWORK__NOISY, NETWORK__DISCOVERY, EMAIL__PHISHING, EMAIL__PHISHING_REPORTED, EMAIL__EVASION, EMAIL__MALWARE, EMAIL__MALICIOUS_LINK, EMAIL__GRAYMAIL, EMAIL__SPAM, EMAIL__BUSINESS_EMAIL_COMPROMISE, EMAIL__MAILBOX_RULE, DATA__DATA_TRANSFER, DATA__DATA_SHARE, POSTURE__POSTURE, POSTURE__HEALTH Whether this detection is part of a ChatOps test scenario
Severity level of the detection
INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL Numeric representation of severity for sorting purposes
Whether this detection involves VIP users
Whether this detection involves critical assets
Whether this detection is excluded by an exclusion rule
Name of the team that owns this detection
Description from the source system
User-added notes about the detection
Name of the source that generated this detection
ID of the case this detection belongs to
Timestamp when the detection verdict was assigned
Timestamp when the detection was last updated
Timestamp when the detection was closed
Raw detection data from the most recent refresh
Timestamp of the last successful detection refresh
Helpfulness feedback selected when detection was resolved
happy, neutral, unhappy ID of the integration instance that generated this detection
ID of the original detection if this is a duplicate
AI-generated recommended next steps for this detection
Short identifier for the case this detection belongs to
Timestamp when the detection was escalated
URL for this detection in its source system
Slug identifier for the action taken on this detection
ID of the exclusion rule that matches this detection
Short identifier for the exclusion rule that matches this detection
Whether this detection was automatically contained by the system
Verdict rule configuration that was applied to this detection
Show child attributes
Show child attributes
Email address for ChatOps testing notifications
Phone number for ChatOps testing notifications
ID of the custom detection that detected this detection
ID of the external custom detection rule that matched this detection
Timestamp when auto remediation started
Timestamp when remediation was completed

