Skip to main content
PUT
Create a custom group

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
name
string
required

Display name for the group

entityType
enum<string>
required

Which asset type this group accepts (immutable after creation)

Available options:
user,
endpoint,
any
description
string

Optional description for the group

color
enum<string>

Group color

Available options:
gray,
red,
orange,
amber,
green,
teal,
blue,
indigo,
purple,
pink
chatOpsEnabled
boolean

Whether chat ops is enabled for this group

containmentEnabled
boolean

Whether containment is enabled for this group

sourceSystemUpdates
boolean

When false, outbound updates to the source security product are skipped for detections linked to assets in this group

alwaysNotify
boolean

When true, detections involving assets in this group are always escalated for notification, even when the verdict rule would resolve or only run chat ops

Response

id
string
required
teamId
string
required
name
string
required
slug
string
required
isSystem
boolean
required
entityType
enum<string>
required
Available options:
user,
endpoint,
any
chatOpsEnabled
boolean
required
containmentEnabled
boolean
required
sourceSystemUpdates
boolean
required

When false, outbound updates to the source security product are skipped for detections linked to assets in this group

alwaysNotify
boolean
required

When true, detections involving assets in this group are always escalated for notification, even when the verdict rule would resolve or only run chat ops

createdAt
string
required
description
string | null
color
enum<string> | null
Available options:
gray,
red,
orange,
amber,
green,
teal,
blue,
indigo,
purple,
pink