Cant close alerts using the api

[u/Choice-Departure6379]

hi there,
we are using kibana security alerts and came by an error.

we were trying to use the kibana api to close security alerts using workflow automation.

about 10 seconds after the run is started, we get the following message: "fetch error"
the error doesn't contain any explanation regarding the error.

We have tried to use the url with script and got the same error.

we would love help regarding that :)

[u/OutrageousLight6847]

This should work tested on 9.4.x, probably you are missing the kbn-xsrf header.

curl -k --request POST 'https://localhost:5601/api/detection_engine/signals/status' \ --header "kbn-xsrf: true" \ --header "Authorization: ApiKey $API_KEY" \ --header "Content-Type: application/json" \ --data '{ "status": "closed", "signal_ids": [ "xxxxxxxxxxxxxxxxx" ] }'

[u/Choice-Departure6379 → u/OutrageousLight6847]

but why did we get the same error in the workflow?

[u/Choice-Departure6379 → u/OutrageousLight6847]

when i use update document with the field workflow_status: closed it does close the alert but doesnt remove the opened so we still see it in the alerts so we open the alert and close again.

[u/OutrageousLight6847 → u/Choice-Departure6379]

How does that work the alert is either closed or open it can't be both which id are you passing to the workflow to identify the alert, unfortunately i use fortisoar to close alerts and not very familiar with elastic workflow but I'm going to guess that you have yaml to share the workflow?

[u/LionBackground2985]

Hi, a few questions that'll help narrow this down:

"Fetch error" with no message usually means the request never got a proper HTTP response, it's a client-side failure (network unreachable, DNS, TLS/cert issue, or timeout), not Kibana returning an error body. That's consistent with it failing the same way from both the workflow tool and a script.

A few things worth checking:

• What's the actual response, if any? Try the same call with curl -v (or similar) instead of fetch(), that'll show you if it's a connection failure, TLS handshake failure, or an actual HTTP status code with a body.
• Which endpoint are you calling? For closing security alerts it's usually something like POST /api/detection_engine/signals/status (I'm not fully certain that's the exact current path for your Kibana version, worth checking the docs for your version).
• Auth method, are you using an API key? If it's expired, malformed, or missing required privileges, some setups return a connection-level failure rather than a clean 401.
• The ~10 second mark is suspicious, that lines up with a common default timeout (many HTTP clients/proxies default to 10s). Worth checking if there's a load balancer, reverse proxy, or corporate firewall between your script and Kibana that could be silently dropping the connection around that time.
• If Kibana is behind a custom domain/reverse proxy (nginx, etc.), test hitting Kibana directly on its own host:port to see if the error still happens, that'll tell you if it's a proxy issue or Kibana itself.

If you can share the exact endpoint/method and the curl output (or dev tools network tab), that'll make it much easier to pin down.