About

The Update Threat endpoint allows you to modify an existing custom threat by updating its name, objectives, actions, or result conditions.

The threat ID to be updated must be specified in the request path.

Example for Basic Threat Update

Update a simple custom threat with a single objective containing two actions.

curl --location 'https://api.picussecurity.com/v1/threat-library/threats' \
--header 'Authorization: Bearer access_token' \
--header 'Content-Type: application/json' \
--data-raw '{
    "name": "Updated-Example-Threat",
    "result_condition": "OBJ1",
    "objectives": [
        {
            "name": "Collection",
            "result_condition": "A1 AND A2",
            "action_ids": [
                33043,
                33044
            ]
        }
    ]
}'

{
    "threat": {
        "id": 110669,
        "display_id": 183672,
        "created_at": "2025-06-24T07:19:23.72964766Z",
        "name": "Updated-Example-Threat",
        "severity": "Medium",
        "tags": [
            "Custom"
        ],
        "affected_os": [
            "Windows"
        ],
        "description": ""
    }
}