What this endpoint does

Updates the execution status of a threat hunt job as part of the integration-driven hunting workflow. When an integration picks up a pending job from the Get Pending Jobs endpoint, it should update the job status to "started" before beginning processing, then to "completed" or "failed" when finished. An optional message field can provide details about the execution outcome, and externalId can link the job to a corresponding record in the external integration system. This endpoint only accepts the status values "started", "completed", and "failed" — the "ready" and "abandoned" states are managed by the platform.

Response data

Returns the previous and current status of the job, confirming the status transition. The previousStatus field shows the job's state before the update, and currentStatus shows the new state, enabling the caller to verify the transition occurred as expected. Valid status values in the response include ready, started, completed, abandoned, and failed.