Transition a threat hunt job through its lifecycle (started, completed, failed) with optional outcome details.
What this endpoint does
Updates the execution status of a threat hunt job as part of the integration-driven hunting workflow. Obtain job IDs from Threat Hunting: Get Pending Jobs. Recommended sequence: (1) get a pending job ID, (2) set status: "started", (3) fetch indicators via Threat Hunting: Get Job Indicators and/or rules via Threat Hunting: Get Job Rules, (4) set status: "completed" or "failed". Only started, completed, and failed may be set by integrations — ready and abandoned are platform-managed. Optional message captures outcome details; externalId links to your external system.
Response data
Returns {"previousStatus": "...", "currentStatus": "..."} confirming the transition. Both fields use the full enum: ready, started, completed, abandoned, failed. Returns 404 if job ID not found. Valid state transitions are not documented — handle unexpected results defensively.