When an insight is selected, its status can be changed using the Mark as read, Silence, and Close buttons.
Mark insights as read
Insights are not automatically marked as read when viewed. To mark an insight as read, click Mark as read. To keep an insight as a reminder for later action or review, leave it unread.
Silence insights
An insight can be silenced if it has been viewed, but no action is taken, or it is not closed. Silencing an insight means pausing all notifications for a specific period (e.g., a week, month, custom period, or indefinitely).
The available silence options depend on the insight types. You can silence insights at different levels:
For a specific entity (for example, a particular IP address or policy).
For a specific entity and rule combination (for example, an IP address or policy with a specific rule).
After reviewing an insight, it can be removed from the list by clicking the Close button.
âšī¸
Info
Closed insights are automatically deleted after 30 days unless reopened.
Reopen insights
To reopen a closed insight for further investigation, reassessment, or verification of mitigation effectiveness, in the Status dropdown, select Closed.
Select the insight to reopen, and click the Reopen button.
The insight will reappear in the list on the Security Insights view.
The Security Insights endpoints cover updating insight status and creating silence rules to suppress notifications. Response examples include only the fields used in each step.
Set the following environment variables before running any examples:
To retrieve available insight IDs, use GET /docs/waap/v1/domains/{WAAP_DOMAIN_ID}/insights.
Update insight status
Changes the status of an insight. Use ACKED to mark as read, CLOSED to close it, and OPEN to reopen a closed insight. The call returns the updated insight object.
import os
import gcore
client = gcore.CDB()
domain_id = int(os.environ["WAAP_DOMAIN_ID"])
insight_id = "a1b2c3d4-0000-0000-0000-111122223333"
# Mark as read
insight = client.waap.domains.insights.replace(
insight_id,
domain_id=domain_id,
status="ACKED",
)
print(f"Status: {insight.status}")
# Close
client.waap.domains.insights.replace(insight_id, domain_id=domain_id, status="CLOSED")
# Reopen
client.waap.domains.insights.replace(insight_id, domain_id=domain_id, status="OPEN")
Replace ACKED with CLOSED to close the insight, or OPEN to reopen a closed one.
Silence an insight
Creates a silence rule that suppresses notifications for a specific insight type. Use labels to target a specific entity â an IP address for allowed-high-risk-ip, or a policy ID for attack-on-disabled-policy. An empty labels object silences all insights of that type.
Set expire_at to an ISO 8601 timestamp for a time-limited silence, or null for indefinite. To manage existing silences, see Manage silence rules.
import os
import gcore
client = gcore.CDB()
domain_id = int(os.environ["WAAP_DOMAIN_ID"])
# Silence alerts for a specific high-risk IP for 30 days
silence = client.waap.domains.insight_silences.create(
domain_id,
insight_type="allowed-high-risk-ip",
author="security-team",
comment="Trusted internal scanner â suppress for 30 days",
labels={"ip": "198.51.100.42"},
expire_at="2026-07-25T00:00:00Z",
)
print(f"Created: {silence.id} expires: {silence.expire_at}")
package main
import (
"context"
"fmt"
"os"
"strconv"
"time"
"github.com/G-Core/gcore-go"
"github.com/G-Core/gcore-go/waap"
)
func main() {
domainID, _ := strconv.ParseInt(os.Getenv("WAAP_DOMAIN_ID"), 10, 64)
client := gcore.NewClient()
expiry := time.Now().AddDate(0, 0, 30)
// Silence alerts for a specific high-risk IP for 30 days
silence, err := client.Waap.Domains.InsightSilences.New(
context.Background(),
domainID,
waap.DomainInsightSilenceNewParams{
InsightType: "allowed-high-risk-ip",
Author: "security-team",
Comment: "Trusted internal scanner â suppress for 30 days",
Labels: map[string]string{"ip": "198.51.100.42"},
ExpireAt: gcore.Time(expiry),
},
)
if err != nil {
panic(err)
}
fmt.Printf("Created: %s expires: %s\n", silence.ID, silence.ExpireAt)
}
