genian-edr-set-threat-state
Changes the state, verdict or memo of a threat like the threat manage panel; what is not given keeps its value. This command changes the console, so profile is required.
genian-edr-set-threat-state profile=VALUE threat-id=VALUE [state=VALUE] [decision=VALUE] [memo=VALUE]
- profile=VALUE
- Required. Genian EDR connect profile name. Required: a change is made on exactly one console.
- threat-id=VALUE
- Required. Threat to change, the threat_id of genian-edr-threats
- state=VALUE
- Optional. New state: new, inprogress or resolved
- decision=VALUE
- Optional. New verdict: true (malicious), false (safe) or unknown (on hold)
- memo=VALUE
- Optional. Memo to keep on the threat
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| threat_id | String | Threat ID | e.g. 5f1c9e3a7d2b48c6a0e4f81b3d9c2a76. ID of the threat, what the threat-id option takes. |
| old_state | String | Old state | e.g. new. State before the change. |
| state | String | State | e.g. inprogress. State after the change. |
| old_decision | String | Old verdict | e.g. unknown. Verdict before the change. |
| decision | String | Verdict | e.g. true. Verdict after the change. |