> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/api-documentation/api-reference/api--response-center/mutations/update-incident-indicator.md).

# updateIncidentIndicator

Edit an indicator (version range / fixed versions; re-runs the matcher).

### Examples

{% tabs %}
{% tab title="GraphQL" %}

```graphql
mutation UpdateIncidentIndicator($incidentId: String!, $indicatorId: String!, $input: UpdateIndicatorInput!) {
  updateIncidentIndicator(incidentId: $incidentId, indicatorId: $indicatorId, input: $input) {
    id
    incidentId
    kind
    value
    versionRange
    fixedVersions
    remediationStatus
    remediations {
      action
      versions
      source
      vendor
      product
      packageName
      collectionUrl
      versionType
      affectedRange
    }
    isCompromised
    isCompromisedBasis
    infectsOnInstall
    ecosystem
    severity
    cvssScore
    cveIntelligence {
      exploitationStatus
      firstReportedExploitationAt
      firstObservedExploitationAt
      kev {
        status
        checkedAt
        catalogFetchedAt
        catalogVersion
        dateReleased
        dateAdded
        dueDate
        requiredAction
        knownRansomwareCampaignUse
      }
      euKev {
        status
        checkedAt
        catalogFetchedAt
        source
        sourceDisplayName
        cve
        euvdId
        dateReported
        originSource
        exploitationTypes
        threatActors
        notes
      }
      articleEvidence {
        sourceUrl
        sourcePublishedAt
        analyzedAt
        analysisVersion
        articleTypes
        classificationConfidence
        claims {
          claimType
          reportingRelationship
          attributedSource
          explicitlyObservedAt
          evidenceExcerpt
          confidence
        }
      }
    }
    cweMetadata {
      status
      cwes
      provenance {
        source
        cwes
      }
      vulnerabilityClass
      vulnerabilityClassSource
      mappingVersion
      resolvedAt
    }
    addedAt
    source
    addedBy
    status
    url
    lastFetchedAt
    autoExpand
    matchState
    activeMatchCount
    isUnpinned
  }
}
```

#### Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

```json
{
  "incidentId": "example",
  "indicatorId": "example",
  "input": {
    "versionRange": "example",
    "fixedVersions": ["example"],
    "remediationStatus": "known",
    "remediations": [
      {
        "action": "upgrade",
        "versions": ["example"],
        "vendor": "example",
        "product": "example",
        "packageName": "example",
        "collectionUrl": "example",
        "versionType": "example",
        "affectedRange": "example"
      }
    ]
  }
}
```

{% endtab %}

{% tab title="cURL" %}

```shell
curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "mutation UpdateIncidentIndicator($incidentId: String!, $indicatorId: String!, $input: UpdateIndicatorInput!) { updateIncidentIndicator(incidentId: $incidentId, indicatorId: $indicatorId, input: $input) { id incidentId kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cveIntelligence { exploitationStatus firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } } cweMetadata { status cwes provenance { source cwes } vulnerabilityClass vulnerabilityClassSource mappingVersion resolvedAt } addedAt source addedBy status url lastFetchedAt autoExpand matchState activeMatchCount isUnpinned } }",
 "variables": {
    "incidentId": "example",
    "indicatorId": "example",
    "input": {
      "versionRange": "example",
      "fixedVersions": ["example"],
      "remediationStatus": "known",
      "remediations": [
        {
          "action": "upgrade",
          "versions": ["example"],
          "vendor": "example",
          "product": "example",
          "packageName": "example",
          "collectionUrl": "example",
          "versionType": "example",
          "affectedRange": "example"
        }
      ]
    }
  }
}'
```

{% endtab %}

{% tab title="Node.js" %}

```javascript
const query = 'mutation UpdateIncidentIndicator($incidentId: String!, $indicatorId: String!, $input: UpdateIndicatorInput!) { updateIncidentIndicator(incidentId: $incidentId, indicatorId: $indicatorId, input: $input) { id incidentId kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cveIntelligence { exploitationStatus firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } } cweMetadata { status cwes provenance { source cwes } vulnerabilityClass vulnerabilityClassSource mappingVersion resolvedAt } addedAt source addedBy status url lastFetchedAt autoExpand matchState activeMatchCount isUnpinned } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      incidentId: "example",
      indicatorId: "example",
      input: {
        versionRange: "example",
        fixedVersions: ["example"],
        remediationStatus: "known",
        remediations: [
          {
            action: "upgrade",
            versions: ["example"],
            vendor: "example",
            product: "example",
            packageName: "example",
            collectionUrl: "example",
            versionType: "example",
            affectedRange: "example"
          }
        ]
      }
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));
```

{% endtab %}

{% tab title="Python" %}

```python
import requests

query = 'mutation UpdateIncidentIndicator($incidentId: String!, $indicatorId: String!, $input: UpdateIndicatorInput!) { updateIncidentIndicator(incidentId: $incidentId, indicatorId: $indicatorId, input: $input) { id incidentId kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cveIntelligence { exploitationStatus firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } } cweMetadata { status cwes provenance { source cwes } vulnerabilityClass vulnerabilityClassSource mappingVersion resolvedAt } addedAt source addedBy status url lastFetchedAt autoExpand matchState activeMatchCount isUnpinned } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "incidentId": "example",
      "indicatorId": "example",
      "input": {
        "versionRange": "example",
        "fixedVersions": ["example"],
        "remediationStatus": "known",
        "remediations": [
          {
            "action": "upgrade",
            "versions": ["example"],
            "vendor": "example",
            "product": "example",
            "packageName": "example",
            "collectionUrl": "example",
            "versionType": "example",
            "affectedRange": "example"
          }
        ]
      }
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)
```

{% endtab %}
{% endtabs %}

### Arguments

You can use the following argument(s) to customize your `updateIncidentIndicator` mutation.

| Argument                                                                                                                                                                                    | Description | Supported fields                                                                                                                                                                                                                                                                                                                                                                                                                         |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| incidentId `String!` <mark style="color:red;background-color:red;">required</mark>                                                                                                          |             |                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| indicatorId `String!` <mark style="color:red;background-color:red;">required</mark>                                                                                                         |             |                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| input [`UpdateIndicatorInput!`](/api-documentation/api-reference/api--response-center/types/inputs/update-indicator-input.md) <mark style="color:red;background-color:red;">required</mark> |             | <p>versionRange <code>String</code><br>fixedVersions <code>\[String!]</code><br>remediationStatus <a href="/api-documentation/api-reference/api--response-center/types/enums/indicator-remediation-status.md"><code>IndicatorRemediationStatus</code></a><br>remediations <a href="/api-documentation/api-reference/api--response-center/types/inputs/indicator-remediation-input.md"><code>\[IndicatorRemediationInput!]</code></a></p> |

### Fields

Return type: [`Indicator!`](/api-documentation/api-reference/api--response-center/types/objects/indicator.md)

You can use the following field(s) to specify what information your `updateIncidentIndicator` mutation will return. Please note that some fields may have their own subfields.

| Field                                                                                                                                               | Description                                                                               | Supported fields                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| --------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| id `String!`                                                                                                                                        |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| incidentId `String!`                                                                                                                                |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| kind [`IndicatorKind!`](/api-documentation/api-reference/api--response-center/types/enums/indicator-kind.md)                                        |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| value `String!`                                                                                                                                     |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| versionRange `String`                                                                                                                               |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| fixedVersions `[String!]!`                                                                                                                          |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| remediationStatus [`IndicatorRemediationStatus`](/api-documentation/api-reference/api--response-center/types/enums/indicator-remediation-status.md) |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| remediations [`[IndicatorRemediation!]!`](/api-documentation/api-reference/api--response-center/types/objects/indicator-remediation.md)             |                                                                                           | <p>action <a href="/api-documentation/api-reference/api--response-center/types/enums/indicator-remediation-action.md"><code>IndicatorRemediationAction!</code></a><br>versions <code>\[String!]!</code><br>source <code>String</code><br>vendor <code>String</code><br>product <code>String</code><br>packageName <code>String</code><br>collectionUrl <code>String</code><br>versionType <code>String</code><br>affectedRange <code>String</code></p>                                                                                                                                                                                                                                                                                                |
| isCompromised `Boolean`                                                                                                                             |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| isCompromisedBasis `String`                                                                                                                         |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| infectsOnInstall `Boolean`                                                                                                                          |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| ecosystem `String`                                                                                                                                  |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| severity [`IncidentSeverity`](/api-documentation/api-reference/api--response-center/types/enums/incident-severity.md)                               |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| cvssScore `Float`                                                                                                                                   |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| cveIntelligence [`CveIntelligence`](/api-documentation/api-reference/api--response-center/types/objects/cve-intelligence.md)                        | Response Center-owned exploitation and official KEV intelligence for a CVE indicator.     | <p>exploitationStatus <a href="/api-documentation/api-reference/api--response-center/types/enums/cve-exploitation-status.md"><code>CveExploitationStatus!</code></a><br>firstReportedExploitationAt <code>DateTime</code><br>firstObservedExploitationAt <code>DateTime</code><br>kev <a href="/api-documentation/api-reference/api--response-center/types/objects/cisa-kev-observation.md"><code>CisaKevObservation!</code></a><br>euKev <a href="/api-documentation/api-reference/api--response-center/types/objects/eu-kev-observation.md"><code>EuKevObservation</code></a><br>articleEvidence <a href="/api-documentation/api-reference/api--response-center/types/objects/cve-article-evidence.md"><code>\[CveArticleEvidence!]!</code></a></p> |
| cweMetadata [`CweMetadata`](/api-documentation/api-reference/api--response-center/types/objects/cwe-metadata.md)                                    | Response Center-owned CWE resolution and derived vulnerability class for a CVE indicator. | <p>status <a href="/api-documentation/api-reference/api--response-center/types/enums/cwe-metadata-status.md"><code>CweMetadataStatus!</code></a><br>cwes <code>\[String!]!</code><br>provenance <a href="/api-documentation/api-reference/api--response-center/types/objects/cwe-provenance-entry.md"><code>\[CweProvenanceEntry!]!</code></a><br>vulnerabilityClass <a href="/api-documentation/api-reference/api--response-center/types/enums/cve-vulnerability-class.md"><code>CveVulnerabilityClass</code></a><br>vulnerabilityClassSource <a href="/api-documentation/api-reference/api--response-center/types/enums/cwe-source.md"><code>CweSource</code></a><br>mappingVersion <code>String!</code><br>resolvedAt <code>DateTime!</code></p>   |
| addedAt `DateTime!`                                                                                                                                 |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| source `String!`                                                                                                                                    |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| addedBy `String`                                                                                                                                    |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| status `String!`                                                                                                                                    |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| url `String`                                                                                                                                        |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| lastFetchedAt `DateTime`                                                                                                                            |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| autoExpand `Boolean`                                                                                                                                |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| matchState [`IndicatorMatchState`](/api-documentation/api-reference/api--response-center/types/enums/indicator-match-state.md)                      |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| activeMatchCount `Int`                                                                                                                              |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| isUnpinned `Boolean`                                                                                                                                |                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ox.security/api-documentation/api-reference/api--response-center/mutations/update-incident-indicator.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.