Applies a partial update to an alert source's verdict-based action configuration. Only fields listed in update_mask are modified. Changes apply to future alerts only.
The alert source ID to update. This property is required.
The fields to update. The only supported value is "verdictActions" — field-mask paths use lowerCamelCase (the proto3 JSON convention), not snake_case. Fields not listed are left unchanged. This property is required.
The verdict-to-action mappings to update. When listed in update_mask, each entry overrides the action for its verdict. Verdicts not listed keep their current action.
A single mapping from a verdict to its post-triage action.
The verdict. Accepted values: "True Positive - Malicious", "True Positive - Benign", "False Positive".
The post-triage action for this verdict. Accepted values: "open_case", "trigger_workflow", "do_nothing".
A successful response.
The verdict-based action configuration for an alert source.
The alert source identifier.
The verdict-to-action mappings, one entry per verdict.
A single mapping from a verdict to its post-triage action.
The verdict. Accepted values: "True Positive - Malicious", "True Positive - Benign", "False Positive".
The post-triage action for this verdict. Accepted values: "open_case", "trigger_workflow", "do_nothing".
The timestamp when the configuration was last updated.
Invalid bearer token. If you receive this message more than once try creating a new Client ID/Client Secret or generating a new bearer token.
You don't have permission to access this resource.