SOAR playbooks: acknowledge, assign, remediate

Drive incident and event actions from your SOAR platform. Acknowledge, assign, and remediate in response to a trigger, with idempotent writes that survive playbook retries.

Endpoints

Operation	Endpoint
Combined incident update	PATCH /v2/incidents/{id}
Dedicated incident assignee route	PATCH /v2/incidents/{id}/assignee
Combined event update (status, assignee, comment)	PATCH /v2/events/{id}
Dedicated event assignee route	PATCH /v2/events/{id}/assignee
Event comment	POST /v2/events/{id}/comments
Remediate an event	POST /v2/events/{id}/remediate

Acknowledge and assign in one call

The combined PATCH takes assignee_email alongside status, priority, and comment. Passing null unassigns:

curl -s -X PATCH "https://api.cloudsek.com/v2/incidents/XVA-24388918" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "status": "Acknowledged", "assignee_email": "[email protected]", "comment": "Auto-triaged by playbook P-42." }'

The assignee must be an active member of the incident's org, or the write fails with USER_NOT_FOUND or a 403 assignee error. Nothing is partially applied.

Remediate an event

Remediation is a transition to a Closed* status with a closure narrative:

curl -s -X POST "https://api.cloudsek.com/v2/events/$EVENT_ID/remediate" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "status": "ClosedResolved", "comment": "Takedown confirmed, playbook P-42 complete." }'

Behaviour that matters for automation

• Retries are safe by design. An identical remediation replay returns the prior operation_id with a 200. If your playbook times out and fires again, you get the same operation, not a duplicate. The comment is the exception: remediation always writes its closure comment, so keep the comment text identical across retries if you do not want a second one.
• Rescan redirects. When rescan is enabled for the event's module, a write against a stale event ID is transparently redirected to the latest event in the series. The response carries rescan_redirect_applied: true plus the identifier you originally sent.
• Events have no priority. Event severity is expressed as magnitude on the read APIs, and magnitude updates are not part of this release. The event PATCH takes status, assignee, and comment.

Next

To act on many records at once instead of one per call, use Bulk triage with async jobs.