Update device threat

Update the status of a convicted threat to either waive or quarantine. To update a threat on a device requires the modify permission for the threats privilege in an integration. See authorization below.

Service Endpoint

/devices/v2/{unique_device_id}/threats

Optional query string parameters

—

Example

https://protectapi.cylance.com/devices/v2/e378dacb-9324-453a-b8c6-5a8406952195/threats

Method

HTTP/1.1 POST

Request headers
  • Accept: application/json
  • Authorization: Bearer JWT Token returned by Auth API with the threat:update scope encoded
  • Content-Type: application/json

Request

JSON 
{
    "threat_id": "bf17366ee3bb8068a9ad70fc9e68496e7e311a055bf4ffeeff53cc5d29ccce52",
    "event": "Quarantine"
}

Response

For more information, see Response status codes.

Response JSON schema

Field Name Description

event

The requested status update for the convicted threat, either quarantine or waive.

threat_id

The SHA256 hash of the convicted threat.