UpdateInvestigationState

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/acronis/main/json-schema/acronis-update-investigation-state-schema.json",
  "title": "UpdateInvestigationState",
  "description": "The investigation state update by a MDR vendor.\n",
  "x-generated": "2026-10-27",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/acronis-incidents-api-openapi.yml#/components/schemas/UpdateInvestigationState",
  "type": "object",
  "properties": {
    "comment": {
      "description": "Optional comment related to the incident update.",
      "type": "string"
    },
    "state": {
      "description": "Updated state of the investigation in an MDR system, may include MDR specific states.\nIt is up to the MDR application logic to apply MDR status to EDR.\n",
      "anyOf": [
        {
          "$ref": "#/$defs/InvestigationState"
        },
        {
          "type": "string"
        }
      ]
    },
    "ticket_subject": {
      "description": "External ticket subject.",
      "type": "string"
    },
    "assignee": {
      "description": "Name of an external agent assigned to the ticket.",
      "type": "string"
    },
    "assignee_id": {
      "description": "User ID of agent assigned to the ticket.\nMust contain an UUID of a registered user with access rights to the incident.\n",
      "type": "string",
      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
    },
    "ticket_id": {
      "description": "External ticket ID associated with the incident.",
      "type": "string"
    },
    "priority": {
      "description": "Priority assigned to the ticket.",
      "enum": [
        "LOW",
        "MEDIUM",
        "HIGH",
        "CRITICAL"
      ],
      "type": "string"
    }
  },
  "$defs": {
    "InvestigationState": {
      "description": "Incident investigation state.",
      "enum": [
        "NOT_STARTED",
        "INVESTIGATING",
        "TRIAGED",
        "FALSE_POSITIVE",
        "CLOSED"
      ],
      "type": "string"
    }
  }
}