Update Alert Notes API

// Document investigation findings
await updateAlertNotes("alert-123", 
  "Investigation Summary:\n" +
  "- Analyzed source IP: 192.168.1.100\n" +
  "- Reviewed firewall logs for the past 24 hours\n" +  
  "- Contacted user for verification\n" +
  "- Determined as legitimate access from approved device\n" +
  "- No further action required"
);

# Document false positive reasoning
update_alert_notes("alert-456", 
    "FALSE POSITIVE: Alert triggered by scheduled backup process. "
    "Backup runs daily at 2 AM. Added exception rule to prevent future alerts."
)

// Document escalation
const escalationNote = 
  "ESCALATED TO SECURITY TEAM:\n" +
  "- High severity alert confirmed as potential breach\n" +
  "- Initial response completed at " + new Date().toISOString() + "\n" +
  "- Assigned to: security-team@company.com\n" +
  "- Next steps: Full forensic investigation required";

await updateAlertNotes("alert-789", escalationNote);

# Clear existing notes
update_alert_notes("alert-101", "")

const createInvestigationNote = (alertId, findings) => {
  const timestamp = new Date().toISOString();
  const analyst = "john.doe@company.com";
  
  const structuredNote = 
    "=== INVESTIGATION REPORT ===\n" +
    `Timestamp: ${timestamp}\n` +
    `Analyst: ${analyst}\n` +
    `Alert ID: ${alertId}\n\n` +
    "INITIAL ASSESSMENT:\n" +
    `${findings.assessment}\n\n` +
    "INVESTIGATION STEPS:\n" +
    findings.steps.map((step, index) => `${index + 1}. ${step}`).join('\n') + "\n\n" +
    "EVIDENCE:\n" +
    `${findings.evidence}\n\n` +
    "CONCLUSION:\n" +
    `${findings.conclusion}\n\n` +
    "NEXT ACTIONS:\n" +
    `${findings.nextActions}\n` +
    "=== END REPORT ===";
  
  return updateAlertNotes(alertId, structuredNote);
};

// Usage
await createInvestigationNote("alert-123", {
  assessment: "Medium severity - suspicious login from new location",
  steps: [
    "Verified user identity through secondary channels",
    "Checked login history for similar patterns", 
    "Analyzed geolocation data",
    "Contacted user directly via phone"
  ],
  evidence: "User confirmed legitimate travel to new location. Phone verification successful.",
  conclusion: "Legitimate user activity - false positive",
  nextActions: "Add travel notification to user profile. No further investigation needed."
});

post:
  summary: "Add or update notes for an alert"
  tags:
    - Alert Management
  security:
    - bearerAuth: []
  parameters:
    - name: alertId
      in: query
      required: true
      schema:
        type: string
        format: uuid
      description: "UUID of the alert to update"
  requestBody:
    required: true
    content:
      application/json:
        schema:
          type: string
          description: "Notes content as a JSON string"
  responses:
    '200':
      description: "Notes updated successfully"
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
                example: "Notes updated successfully"
    '400':
      description: "Invalid alert ID or request format"
    '401':
      description: "Unauthorized"
    '404':
      description: "Alert not found"
    '500':
      description: "Internal server error"