updateIncidentSeverity

Change an incident severity (re-derives the SLA target).

Examples

GraphQL

mutation UpdateIncidentSeverity($incidentId: String!, $severity: String!, $comment: String, $authorName: String) {
  updateIncidentSeverity(incidentId: $incidentId, severity: $severity, comment: $comment, authorName: $authorName) {
    id
    caseId
    name
    description
    type
    severity
    status
    classification {
      attackType
      campaignName
      primaryImpact
      secondaryImpacts
      impactTargets
      capabilities
      executionTriggers
      evidence {
        attackType
        campaignName
        primaryImpact
        secondaryImpacts
        impactTargets
        capabilities
        executionTriggers
      }
      metadataContractVersion
    }
    scope
    exploitationStatus
    blockedReason
    owner
    creator
    slaTargetAt
    settings {
      allowManualClosure
      autoCloseWhenResolved
      cleanDaysBeforeClose
      autoReopenOnNewHit
      watchWindowDays
    }
    isOxDeclared
    publishType
    publishTypeReason
    autoExpandFromSource
    externalReferences
    sourceCreatedAt
    kevDiscoveredAt
    oxPublishedAt
    counts {
      affectedApps
      affectedRepos
      affectedImages
      openFindings
      resolvedFindings
      removedFindings
      sbomMatches
      removedSbomMatches
      pipelineHits
      devEnvironments
      clearedMatches
      blockedItems
      cloudAccounts
      cloudRunningImages
      cloudRunningThisVersionImages
      openFindingsBySeverity {
        appoxalypse
        critical
        high
        medium
        low
      }
    }
    exposureState
    currentSeverity
    isMonitoring
    affectedResourceCount
    summary {
      title
      bullets
      lines {
        segments {
          text
          emphasis
        }
      }
    }
    aiSummary {
      bullets
      generatedAt
      model
    }
    indicatorCounts {
      cve
      package
      packageRange
      image
      issue
      advisorySource
    }
    lastRunDelta {
      newCount
      resolvedCount
      removedCount
      issues {
        newCount
        resolvedCount
        removedCount
      }
      sboms {
        newCount
        resolvedCount
        removedCount
      }
    }
    countsAsOf
    lastMatchedAt
    lastExposureChange
    resolvedAt
    createdAt
    updatedAt
    indicators {
      id
      incidentId
      kind
      value
      versionRange
      fixedVersions
      remediationStatus
      remediations {
        action
        versions
        source
        vendor
        product
        packageName
        collectionUrl
        versionType
        affectedRange
      }
      isCompromised
      isCompromisedBasis
      infectsOnInstall
      ecosystem
      severity
      cvssScore
      cveIntelligence {
        exploitationStatus
        firstReportedExploitationAt
        firstObservedExploitationAt
        kev {
          status
          checkedAt
          catalogFetchedAt
          catalogVersion
          dateReleased
          dateAdded
          dueDate
          requiredAction
          knownRansomwareCampaignUse
        }
        euKev {
          status
          checkedAt
          catalogFetchedAt
          source
          sourceDisplayName
          cve
          euvdId
          dateReported
          originSource
          exploitationTypes
          threatActors
          notes
        }
        articleEvidence {
          sourceUrl
          sourcePublishedAt
          analyzedAt
          analysisVersion
          articleTypes
          classificationConfidence
          claims {
            claimType
            reportingRelationship
            attributedSource
            explicitlyObservedAt
            evidenceExcerpt
            confidence
          }
        }
      }
      cweMetadata {
        status
        cwes
        provenance {
          source
          cwes
        }
        vulnerabilityClass
        vulnerabilityClassSource
        mappingVersion
        resolvedAt
      }
      addedAt
      source
      addedBy
      status
      url
      lastFetchedAt
      autoExpand
      matchState
      activeMatchCount
      isUnpinned
    }
  }
}

Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

{
  "incidentId": "example",
  "severity": "2",
  "comment": "some comment",
  "authorName": "example"
}

cURL

curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "mutation UpdateIncidentSeverity($incidentId: String!, $severity: String!, $comment: String, $authorName: String) { updateIncidentSeverity(incidentId: $incidentId, severity: $severity, comment: $comment, authorName: $authorName) { id caseId name description type severity status classification { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers evidence { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers } metadataContractVersion } scope exploitationStatus blockedReason owner creator slaTargetAt settings { allowManualClosure autoCloseWhenResolved cleanDaysBeforeClose autoReopenOnNewHit watchWindowDays } isOxDeclared publishType publishTypeReason autoExpandFromSource externalReferences sourceCreatedAt kevDiscoveredAt oxPublishedAt counts { affectedApps affectedRepos affectedImages openFindings resolvedFindings removedFindings sbomMatches removedSbomMatches pipelineHits devEnvironments clearedMatches blockedItems cloudAccounts cloudRunningImages cloudRunningThisVersionImages openFindingsBySeverity { appoxalypse critical high medium low } } exposureState currentSeverity isMonitoring affectedResourceCount summary { title bullets lines { segments { text emphasis } } } aiSummary { bullets generatedAt model } indicatorCounts { cve package packageRange image issue advisorySource } lastRunDelta { newCount resolvedCount removedCount issues { newCount resolvedCount removedCount } sboms { newCount resolvedCount removedCount } } countsAsOf lastMatchedAt lastExposureChange resolvedAt createdAt updatedAt indicators { id incidentId kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cveIntelligence { exploitationStatus firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } } cweMetadata { status cwes provenance { source cwes } vulnerabilityClass vulnerabilityClassSource mappingVersion resolvedAt } addedAt source addedBy status url lastFetchedAt autoExpand matchState activeMatchCount isUnpinned } } }",
 "variables": {
    "incidentId": "example",
    "severity": "2",
    "comment": "some comment",
    "authorName": "example"
  }
}'

Node.js

const query = 'mutation UpdateIncidentSeverity($incidentId: String!, $severity: String!, $comment: String, $authorName: String) { updateIncidentSeverity(incidentId: $incidentId, severity: $severity, comment: $comment, authorName: $authorName) { id caseId name description type severity status classification { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers evidence { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers } metadataContractVersion } scope exploitationStatus blockedReason owner creator slaTargetAt settings { allowManualClosure autoCloseWhenResolved cleanDaysBeforeClose autoReopenOnNewHit watchWindowDays } isOxDeclared publishType publishTypeReason autoExpandFromSource externalReferences sourceCreatedAt kevDiscoveredAt oxPublishedAt counts { affectedApps affectedRepos affectedImages openFindings resolvedFindings removedFindings sbomMatches removedSbomMatches pipelineHits devEnvironments clearedMatches blockedItems cloudAccounts cloudRunningImages cloudRunningThisVersionImages openFindingsBySeverity { appoxalypse critical high medium low } } exposureState currentSeverity isMonitoring affectedResourceCount summary { title bullets lines { segments { text emphasis } } } aiSummary { bullets generatedAt model } indicatorCounts { cve package packageRange image issue advisorySource } lastRunDelta { newCount resolvedCount removedCount issues { newCount resolvedCount removedCount } sboms { newCount resolvedCount removedCount } } countsAsOf lastMatchedAt lastExposureChange resolvedAt createdAt updatedAt indicators { id incidentId kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cveIntelligence { exploitationStatus firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } } cweMetadata { status cwes provenance { source cwes } vulnerabilityClass vulnerabilityClassSource mappingVersion resolvedAt } addedAt source addedBy status url lastFetchedAt autoExpand matchState activeMatchCount isUnpinned } } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      incidentId: "example",
      severity: "2",
      comment: "some comment",
      authorName: "example"
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));

Python

import requests

query = 'mutation UpdateIncidentSeverity($incidentId: String!, $severity: String!, $comment: String, $authorName: String) { updateIncidentSeverity(incidentId: $incidentId, severity: $severity, comment: $comment, authorName: $authorName) { id caseId name description type severity status classification { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers evidence { attackType campaignName primaryImpact secondaryImpacts impactTargets capabilities executionTriggers } metadataContractVersion } scope exploitationStatus blockedReason owner creator slaTargetAt settings { allowManualClosure autoCloseWhenResolved cleanDaysBeforeClose autoReopenOnNewHit watchWindowDays } isOxDeclared publishType publishTypeReason autoExpandFromSource externalReferences sourceCreatedAt kevDiscoveredAt oxPublishedAt counts { affectedApps affectedRepos affectedImages openFindings resolvedFindings removedFindings sbomMatches removedSbomMatches pipelineHits devEnvironments clearedMatches blockedItems cloudAccounts cloudRunningImages cloudRunningThisVersionImages openFindingsBySeverity { appoxalypse critical high medium low } } exposureState currentSeverity isMonitoring affectedResourceCount summary { title bullets lines { segments { text emphasis } } } aiSummary { bullets generatedAt model } indicatorCounts { cve package packageRange image issue advisorySource } lastRunDelta { newCount resolvedCount removedCount issues { newCount resolvedCount removedCount } sboms { newCount resolvedCount removedCount } } countsAsOf lastMatchedAt lastExposureChange resolvedAt createdAt updatedAt indicators { id incidentId kind value versionRange fixedVersions remediationStatus remediations { action versions source vendor product packageName collectionUrl versionType affectedRange } isCompromised isCompromisedBasis infectsOnInstall ecosystem severity cvssScore cveIntelligence { exploitationStatus firstReportedExploitationAt firstObservedExploitationAt kev { status checkedAt catalogFetchedAt catalogVersion dateReleased dateAdded dueDate requiredAction knownRansomwareCampaignUse } euKev { status checkedAt catalogFetchedAt source sourceDisplayName cve euvdId dateReported originSource exploitationTypes threatActors notes } articleEvidence { sourceUrl sourcePublishedAt analyzedAt analysisVersion articleTypes classificationConfidence claims { claimType reportingRelationship attributedSource explicitlyObservedAt evidenceExcerpt confidence } } } cweMetadata { status cwes provenance { source cwes } vulnerabilityClass vulnerabilityClassSource mappingVersion resolvedAt } addedAt source addedBy status url lastFetchedAt autoExpand matchState activeMatchCount isUnpinned } } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "incidentId": "example",
      "severity": "2",
      "comment": "some comment",
      "authorName": "example"
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)

Arguments

You can use the following argument(s) to customize your updateIncidentSeverity mutation.

Argument	Description	Supported fields
incidentId String! required
severity String! required
comment String
authorName String

Fields

Return type: Incident!

You can use the following field(s) to specify what information your updateIncidentSeverity mutation will return. Please note that some fields may have their own subfields.

Field	Description	Supported fields
id String!
caseId String!
name String!
description String
type IncidentType!
severity IncidentSeverity!
status IncidentStatus!
classification IncidentClassification	Structured threat classification extracted from the incident sources. Absent until a source establishes one.	attackType IncidentAttackType campaignName String primaryImpact IncidentImpact secondaryImpacts [IncidentImpact!] impactTargets [IncidentImpactTarget!] capabilities [IncidentCapability!] executionTriggers [IncidentExecutionTrigger!] evidence IncidentClassificationEvidence metadataContractVersion String
scope IncidentScope	Derived breadth of the monitored threat. Populated on the detail query.
exploitationStatus CveExploitationStatus	The strongest stored exploitation posture across the monitored CVEs. Absent on the list query and for incidents that monitor no CVEs.
blockedReason String
owner String
creator String!
slaTargetAt DateTime
settings IncidentSettings!		allowManualClosure Boolean! autoCloseWhenResolved Boolean! cleanDaysBeforeClose Int! autoReopenOnNewHit Boolean! watchWindowDays Int!
isOxDeclared Boolean!
publishType IncidentPublishType!	The immutable product flow that originally published this incident.
publishTypeReason String	The immutable flow-specific publication reason. Legacy incidents may not have one.
autoExpandFromSource Boolean!
externalReferences [String!]!
sourcePublishedAt DateTime ⚠️	Deprecated: Use sourceCreatedAt.
sourceCreatedAt DateTime	Publication timestamp of the original GHSA, NVD advisory, or source article.
kevDiscoveredAt DateTime	Earliest accepted discovery date across CISA KEV, VulnCheck KEV, and EU KEV.
oxPublishedAt DateTime	Publication timestamp of the global OX Feed template that created this incident.
counts IncidentCounts!		affectedApps Int! affectedRepos Int! affectedImages Int! openFindings Int! resolvedFindings Int! removedFindings Int! sbomMatches Int! removedSbomMatches Int! pipelineHits Int! devEnvironments Int! clearedMatches Int! blockedItems Int! cloudAccounts Int! cloudRunningImages Int! cloudRunningThisVersionImages Int! openFindingsBySeverity IncidentSeverityCounts!
exposureState ExposureState
currentSeverity IncidentSeverity
isMonitoring Boolean!
affectedResourceCount Int!
summary [IncidentSummarySection!]!		title String! bullets [String!]! lines [IncidentSummaryLine!]!
aiSummary IncidentAiSummary		bullets [String!]! generatedAt DateTime model String
indicatorCounts IncidentIndicatorCounts		cve Int! package Int! packageRange Int! image Int! issue Int! advisorySource Int!
lastRunDelta IncidentLastRunDelta		newCount Int! resolvedCount Int! removedCount Int! issues IncidentRunDelta sboms IncidentRunDelta
countsAsOf DateTime
lastMatchedAt DateTime
lastExposureChange DateTime
resolvedAt DateTime
createdAt DateTime
updatedAt DateTime
indicators [Indicator!]		id String! incidentId String! kind IndicatorKind! value String! versionRange String fixedVersions [String!]! remediationStatus IndicatorRemediationStatus remediations [IndicatorRemediation!]! isCompromised Boolean isCompromisedBasis String infectsOnInstall Boolean ecosystem String severity IncidentSeverity cvssScore Float cveIntelligence CveIntelligence cweMetadata CweMetadata addedAt DateTime! source String! addedBy String status String! url String lastFetchedAt DateTime autoExpand Boolean matchState IndicatorMatchState activeMatchCount Int isUnpinned Boolean