Update vulnerability status, severity, or CVSS
Change status and/or severity, or adjust the CVSS v3.1 base metrics with a required reason. CVSS adjustments cannot be combined with status or severity. The server calculates the score, vector and severity, and preserves the manual rating when scans update the same issue.
Authorizations
API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.
Path Parameters
ID of the vulnerability. Use the id field of a finding from listVulnerabilities.
Body
- Option 1
- Option 2
- Option 3
Provide status and/or severity, or cvss_breakdown plus severity_reason. All eight CVSS v3.1 base metrics and a nonblank reason are required for CVSS adjustments.
New triage status of the finding.
open, in_progress, snoozed, fixed, ignored, not_affected Optional note when changing status.
Required when status is snoozed. The date must be in the future.
New severity of the finding.
critical, high, medium, low Optional for label-only severity changes; required and nonblank when adjusting CVSS.
1000The eight CVSS v3.1 base metric selections.
Response
Updated vulnerability.
open, in_progress, snoozed, fixed, ignored, not_affected critical, high, medium, low trivial, low, medium, high critical, high, medium, low Human-readable STRIX-ID number.
The newest retest of the issue. The value is null when nobody retested the issue.
Manual CVSS adjustment and the rating before the first adjustment. A label-only severity change clears this record without changing the numeric score.