The bulk updates feature lets you change alert statuses for large sets of alerts in one operation. The workflow has two stages: preparing your data file and uploading it for processing.
Step 1: Prepare Your Data File
Start by downloading the provided template. Use this file to enter the list of alerts you want to update. Each row should represent one alert, and all four mandatory columns must be filled in.
Required Columns
alertId
This field identifies the alert you want to update. The value needs to be a valid alert ID from your environment.
Example: A-49129
reason
This field describes the reason for the status update. You can choose any value that aligns with your internal closure or escalation reasons, including the ones configured in Settings → Case management.
Example: False positive
You can also write a custom reason. If the value does not match any predefined reason, the system will treat it as Other and display it as "Other: <your reason>".
Example: Other: Bulk closing due to misconfiguration
comment
This field provides optional context. Use it to explain the reason in more detail. Teams often use this field to give short supporting notes that help reviewers understand why the update was made.
alertStatus
This field indicates the new status you want to assign to the alert. The system supports the following values: CLOSED, ESCALATED, ESCALATED_L2, and REOPENED. Each value must be entered exactly as written.
Example: CLOSED
Review Your File
Once all rows are complete, review the file to make sure there are no missing or malformed entries in any mandatory field.
Step 2: Upload Your File
Export the file in CSV format.
Open the upload modal in the platform, select your CSV file, and click Update.
The platform will validate the content. This includes format checks, field verification, and consistency checks across all rows.
By closing the modal, the validation and upload process will continue in the background.
Additional Notes
The update is irreversible. Once validation is complete and the system processes the file, you cannot revert the changes.
The maximum file size is 2 MB. This limits how many alerts you can include in one upload. When reasons and comments are short, users can usually fit around 30,000 rows.
Alerts that already have the same status will still be updated and replaced with the new information in the file.
You can use different alert status values in one upload. For example, you can update some alerts to CLOSED and others to ESCALATED or REOPENED in the same file.
If the system finds empty fields, invalid values, or structural issues in any row, the entire file will be rejected. All issues must be resolved before reuploading.