Tanium Threat Response "tanium-tr-alert-update-state" command update all alert status rather than specified alert

[JOng39]

We are experiencing the weird behavior, where the "tanium-tr-alert-update-state" command update all alert status.

The full command used is as below
!tanium-tr-alert-update-state alert_ids=2267 state=resolved

I have updated the Tanium Threat Response V2 to latest verison 2.0.15

Please help to look into it and let us know what is the solution.

Thank you.

[cstone]

can you share a screenshot of the output in the playground after you trigger this command? Thanks

[JOng39]

Hi Cstone,

Attached the screenshot

[jfernandes1]

Hi @JOng39, I don't see any issue in the code. Looks like its calling the API like the documentation suggests. You might need to check this with your debug logs on Tanium Threat Response UI. 

You can verify the same using Postman or similar. Refer - https://developer.tanium.com/site/global/docs/how_tos/tr_alert/index.gsp

If this is still an issue after verification, please contact support.