Add a case comment or alert
You must have all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.
Path parameters
-
The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.
Body object Required
The add comment to case API request body varies depending on whether you are adding an alert or a comment.
Defines properties for case comment requests when type is alert.
alertId string | array[string] Required
The alert identifiers. It is required only when
type
isalert
. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule;index
must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.One of: Not more than
1000
elements.index string | array[string] Required
The alert indices. It is required only when
type
isalert
. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in thealertId
array. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.One of: Not more than
1000
elements.-
The application that owns the cases: Stack Management, Observability, or Elastic Security.
Values are
cases
,observability
, orsecuritySolution
. -
The rule that is associated with the alerts. It is required only when
type
isalert
. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. -
The type of comment.
Value is
alert
.
Defines properties for case comment requests when type is user.
-
The new comment. It is required only when
type
isuser
.Maximum length is
30000
. -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
Values are
cases
,observability
, orsecuritySolution
. -
The type of comment.
Value is
user
.
Responses
-
200 application/json; Elastic-Api-Version=2023-10-31
Indicates a successful call.
Hide response attributes Show response attributes object
-
assignees array[object] | null
An array containing users that are assigned to the case.
Not more than
10
elements.Hide assignees attribute Show assignees attribute object
-
A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
-
-
category string | null
The case category.
-
Hide closed_by attributes Show closed_by attributes object | null
-
profile_uid string
-
An array of comment objects for the case.
Not more than
10000
elements.One of: Hide attributes Show attributes
-
alertId array[string]
-
created_at string(date-time)
-
created_by object
Hide created_by attributes Show created_by attributes object
-
profile_uid string
-
id string
-
index array[string]
-
owner string
The application that owns the cases: Stack Management, Observability, or Elastic Security.
Values are
cases
,observability
, orsecuritySolution
. -
pushed_at string(date-time) | null
-
pushed_by object | null
Hide pushed_by attributes Show pushed_by attributes object | null
-
profile_uid string
-
rule object
-
Value is
alert
. -
updated_at string(date-time) | null
-
updated_by object | null
Hide updated_by attributes Show updated_by attributes object | null
-
profile_uid string
-
version string
Hide attributes Show attributes
-
comment string
-
created_at string(date-time)
-
created_by object
Hide created_by attributes Show created_by attributes object
-
profile_uid string
-
id string
-
owner string
The application that owns the cases: Stack Management, Observability, or Elastic Security.
Values are
cases
,observability
, orsecuritySolution
. -
pushed_at string(date-time) | null
-
pushed_by object | null
Hide pushed_by attributes Show pushed_by attributes object | null
-
profile_uid string
-
Value is
user
. -
updated_at string(date-time) | null
-
updated_by object | null
Hide updated_by attributes Show updated_by attributes object | null
-
profile_uid string
-
version string
-
connector object Required
One of: Cases_connector_properties_none object Cases_connector_properties_cases_webhook object Cases_connector_properties_jira object Cases_connector_properties_resilient object Cases_connector_properties_servicenow object Cases_connector_properties_servicenow_sir object Cases_connector_properties_swimlane objectDefines properties for connectors when type is
.none
.Hide attributes Show attributes
-
An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
-
The identifier for the connector. To create a case without a connector, use
none
. To update a case to remove the connector, specifynone
. -
The name of the connector. To create a case without a connector, use
none
. To update a case to remove the connector, specifynone
. -
The type of connector. To create a case without a connector, use
.none
. To update a case to remove the connector, specify.none
.Value is
.none
.
Defines properties for connectors when type is
.cases-webhook
.Hide attributes Show attributes
Defines properties for connectors when type is
.jira
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.jira
.
Defines properties for connectors when type is
.resilient
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attributes Show fields attributes object | null
-
The type of incident.
-
The severity code of the incident.
-
-
The identifier for the connector.
-
The name of the connector.
-
The type of connector.
Value is
.resilient
.
Defines properties for connectors when type is
.servicenow
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attributes Show fields attributes object
-
The category of the incident.
-
The effect an incident had on business.
-
The severity of the incident.
-
The subcategory of the incident.
-
The extent to which the incident resolution can be delayed.
-
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.servicenow
.
Defines properties for connectors when type is
.servicenow-sir
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attributes Show fields attributes object
-
The category of the incident.
-
Indicates whether cases will send a comma-separated list of destination IPs.
-
Indicates whether cases will send a comma-separated list of malware hashes.
-
Indicates whether cases will send a comma-separated list of malware URLs.
-
The priority of the issue.
-
Indicates whether cases will send a comma-separated list of source IPs.
-
The subcategory of the incident.
-
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.servicenow-sir
.
Defines properties for connectors when type is
.swimlane
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attribute Show fields attribute object
-
The case identifier for Swimlane connectors.
-
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.swimlane
.
-
-
Hide created_by attributes Show created_by attributes object
-
profile_uid string
-
customFields array[object]
Custom field values for the case.
Hide customFields attributes Show customFields attributes object
-
key string
The unique identifier for the custom field. The key value must exist in the case configuration settings.
-
type string
The custom field type. It must match the type specified in the case configuration settings.
Values are
text
ortoggle
. value string | null | boolean
The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is
undefined
. The value returned in the API and user interface in this case isnull
.One of: Minimum length is
1
, maximum length is160
.
-
-
The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
-
Hide external_service attributes Show external_service attributes object | null
-
connector_id string
-
connector_name string
-
external_id string
-
external_title string
-
external_url string
-
pushed_at string(date-time)
-
pushed_by object | null
Hide pushed_by attributes Show pushed_by attributes object | null
-
email string | null
-
full_name string | null
-
profile_uid string
-
username string | null
-
-
-
The application that owns the cases: Stack Management, Observability, or Elastic Security.
Values are
cases
,observability
, orsecuritySolution
. -
An object that contains the case settings.
Hide settings attribute Show settings attribute object
-
Turns alert syncing on or off.
-
-
The severity of the case.
Values are
critical
,high
,low
, ormedium
. Default value islow
. -
The status of the case.
Values are
closed
,in-progress
, oropen
. -
Hide updated_by attributes Show updated_by attributes object | null
-
profile_uid string
-
-
401 application/json; Elastic-Api-Version=2023-10-31
Authorization information is missing or invalid.
Hide response attributes Show response attributes object
-
error string
-
message string
-
statusCode integer
-
curl \
-X POST https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments \
-H "Content-Type: application/json; Elastic-Api-Version=2023-10-31" \
-H "kbn-xsrf: string"
{
"type": "user",
"owner": "cases",
"comment": "A new comment."
}
{
"id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
"tags": [
"tag 1"
],
"owner": "cases",
"title": "Case title 1",
"status": "open",
"version": "WzIzMzgsMV0=",
"category": null,
"comments": [
{
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
"type": "user",
"owner": "cases",
"comment": "A new comment.",
"version": "WzIwNDMxLDFd",
"created_at": "2022-10-02T00:49:47.716Z",
"created_by": {
"email": null,
"username": "elastic",
"full_name": null
}
}
],
"duration": null,
"settings": {
"syncAlerts": false
},
"severity": "low",
"assignees": [],
"closed_at": null,
"closed_by": null,
"connector": {
"id": "none",
"name": "none",
"type": ".none",
"fields": null
},
"created_at": "2022-03-24T00:37:03.906Z",
"created_by": {
"email": null,
"username": "elastic",
"full_name": null,
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
},
"updated_at": "2022-06-03T00:49:47.716Z",
"updated_by": {
"email": null,
"username": "elastic",
"full_name": null,
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
},
"description": "A case description.",
"totalAlerts": 0,
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "Field value"
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": true
}
],
"totalComment": 1,
"external_service": null
}
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}