Update cases
You must have all
privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're updating.
Body
-
An array containing one or more case objects.
At least
1
but not more than100
elements.Hide cases attributes Show cases attributes object
-
assignees array[object] | null
An array containing users that are assigned to the case.
Not more than
10
elements.Hide assignees attribute Show assignees attribute object
-
A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
-
-
category string
A word or phrase that categorizes the case.
Maximum length is
50
. connector object
One of: Cases_connector_properties_none object Cases_connector_properties_cases_webhook object Cases_connector_properties_jira object Cases_connector_properties_resilient object Cases_connector_properties_servicenow object Cases_connector_properties_servicenow_sir object Cases_connector_properties_swimlane objectDefines properties for connectors when type is
.none
.Hide attributes Show attributes
-
An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
-
The identifier for the connector. To create a case without a connector, use
none
. To update a case to remove the connector, specifynone
. -
The name of the connector. To create a case without a connector, use
none
. To update a case to remove the connector, specifynone
. -
The type of connector. To create a case without a connector, use
.none
. To update a case to remove the connector, specify.none
.Value is
.none
.
Defines properties for connectors when type is
.cases-webhook
.Defines properties for connectors when type is
.jira
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.jira
.
Defines properties for connectors when type is
.resilient
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attributes Show fields attributes object | null
-
The type of incident.
-
The severity code of the incident.
-
-
The identifier for the connector.
-
The name of the connector.
-
The type of connector.
Value is
.resilient
.
Defines properties for connectors when type is
.servicenow
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attributes Show fields attributes object
-
The category of the incident.
-
The effect an incident had on business.
-
The severity of the incident.
-
The subcategory of the incident.
-
The extent to which the incident resolution can be delayed.
-
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.servicenow
.
Defines properties for connectors when type is
.servicenow-sir
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attributes Show fields attributes object
-
The category of the incident.
-
Indicates whether cases will send a comma-separated list of destination IPs.
-
Indicates whether cases will send a comma-separated list of malware hashes.
-
Indicates whether cases will send a comma-separated list of malware URLs.
-
The priority of the issue.
-
Indicates whether cases will send a comma-separated list of source IPs.
-
The subcategory of the incident.
-
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.servicenow-sir
.
Defines properties for connectors when type is
.swimlane
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attribute Show fields attribute object
-
The case identifier for Swimlane connectors.
-
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.swimlane
.
-
-
customFields array[object]
Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.
At least
0
but not more than10
elements.Hide customFields attributes Show customFields attributes object
-
The unique identifier for the custom field. The key value must exist in the case configuration settings.
-
The custom field type. It must match the type specified in the case configuration settings.
Values are
text
ortoggle
. value string | null | boolean Required
The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is
undefined
. The value returned in the API and user interface in this case isnull
.One of: Minimum length is
1
, maximum length is160
.
-
-
description string
The description for the case.
Maximum length is
30000
. -
The identifier for the case.
Maximum length is
30000
. -
settings object
An object that contains the case settings.
Hide settings attribute Show settings attribute object
-
Turns alert syncing on or off.
-
-
severity string
The severity of the case.
Values are
critical
,high
,low
, ormedium
. Default value islow
. -
status string
The status of the case.
Values are
closed
,in-progress
, oropen
. -
tags array[string]
The words and phrases that help categorize cases. It can be an empty array.
Not more than
200
elements. Maximum length of each is256
. -
title string
A title for the case.
Maximum length is
160
. -
The current version of the case. To determine this value, use the get case or find cases APIs.
-
Responses
-
200 application/json; Elastic-Api-Version=2023-10-31
Indicates a successful call.
Hide response attributes Show response attributes object
-
assignees array[object] | null
An array containing users that are assigned to the case.
Not more than
10
elements.Hide assignees attribute Show assignees attribute object
-
A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
-
-
category string | null
The case category.
-
Hide closed_by attributes Show closed_by attributes object | null
-
profile_uid string
-
An array of comment objects for the case.
Not more than
10000
elements.One of: Hide attributes Show attributes
-
alertId array[string]
-
created_at string(date-time)
-
created_by object
Hide created_by attributes Show created_by attributes object
-
profile_uid string
-
id string
-
index array[string]
-
owner string
The application that owns the cases: Stack Management, Observability, or Elastic Security.
Values are
cases
,observability
, orsecuritySolution
. -
pushed_at string(date-time) | null
-
pushed_by object | null
Hide pushed_by attributes Show pushed_by attributes object | null
-
profile_uid string
-
rule object
-
Value is
alert
. -
updated_at string(date-time) | null
-
updated_by object | null
Hide updated_by attributes Show updated_by attributes object | null
-
profile_uid string
-
version string
Hide attributes Show attributes
-
comment string
-
created_at string(date-time)
-
created_by object
Hide created_by attributes Show created_by attributes object
-
profile_uid string
-
id string
-
owner string
The application that owns the cases: Stack Management, Observability, or Elastic Security.
Values are
cases
,observability
, orsecuritySolution
. -
pushed_at string(date-time) | null
-
pushed_by object | null
Hide pushed_by attributes Show pushed_by attributes object | null
-
profile_uid string
-
Value is
user
. -
updated_at string(date-time) | null
-
updated_by object | null
Hide updated_by attributes Show updated_by attributes object | null
-
profile_uid string
-
version string
-
connector object Required
One of: Cases_connector_properties_none object Cases_connector_properties_cases_webhook object Cases_connector_properties_jira object Cases_connector_properties_resilient object Cases_connector_properties_servicenow object Cases_connector_properties_servicenow_sir object Cases_connector_properties_swimlane objectDefines properties for connectors when type is
.none
.Hide attributes Show attributes
-
An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.
-
The identifier for the connector. To create a case without a connector, use
none
. To update a case to remove the connector, specifynone
. -
The name of the connector. To create a case without a connector, use
none
. To update a case to remove the connector, specifynone
. -
The type of connector. To create a case without a connector, use
.none
. To update a case to remove the connector, specify.none
.Value is
.none
.
Defines properties for connectors when type is
.cases-webhook
.Hide attributes Show attributes
Defines properties for connectors when type is
.jira
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.jira
.
Defines properties for connectors when type is
.resilient
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attributes Show fields attributes object | null
-
The type of incident.
-
The severity code of the incident.
-
-
The identifier for the connector.
-
The name of the connector.
-
The type of connector.
Value is
.resilient
.
Defines properties for connectors when type is
.servicenow
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attributes Show fields attributes object
-
The category of the incident.
-
The effect an incident had on business.
-
The severity of the incident.
-
The subcategory of the incident.
-
The extent to which the incident resolution can be delayed.
-
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.servicenow
.
Defines properties for connectors when type is
.servicenow-sir
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attributes Show fields attributes object
-
The category of the incident.
-
Indicates whether cases will send a comma-separated list of destination IPs.
-
Indicates whether cases will send a comma-separated list of malware hashes.
-
Indicates whether cases will send a comma-separated list of malware URLs.
-
The priority of the issue.
-
Indicates whether cases will send a comma-separated list of source IPs.
-
The subcategory of the incident.
-
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.servicenow-sir
.
Defines properties for connectors when type is
.swimlane
.Hide attributes Show attributes
-
An object containing the connector fields. If you want to omit any individual field, specify null as its value.
Hide fields attribute Show fields attribute object
-
The case identifier for Swimlane connectors.
-
-
The identifier for the connector. To retrieve connector IDs, use the find connectors API.
-
The name of the connector.
-
The type of connector.
Value is
.swimlane
.
-
-
Hide created_by attributes Show created_by attributes object
-
profile_uid string
-
customFields array[object]
Custom field values for the case.
Hide customFields attributes Show customFields attributes object
-
key string
The unique identifier for the custom field. The key value must exist in the case configuration settings.
-
type string
The custom field type. It must match the type specified in the case configuration settings.
Values are
text
ortoggle
. value string | null | boolean
The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is
undefined
. The value returned in the API and user interface in this case isnull
.One of: Minimum length is
1
, maximum length is160
.
-
-
The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.
-
Hide external_service attributes Show external_service attributes object | null
-
connector_id string
-
connector_name string
-
external_id string
-
external_title string
-
external_url string
-
pushed_at string(date-time)
-
pushed_by object | null
Hide pushed_by attributes Show pushed_by attributes object | null
-
email string | null
-
full_name string | null
-
profile_uid string
-
username string | null
-
-
-
The application that owns the cases: Stack Management, Observability, or Elastic Security.
Values are
cases
,observability
, orsecuritySolution
. -
An object that contains the case settings.
Hide settings attribute Show settings attribute object
-
Turns alert syncing on or off.
-
-
The severity of the case.
Values are
critical
,high
,low
, ormedium
. Default value islow
. -
The status of the case.
Values are
closed
,in-progress
, oropen
. -
Hide updated_by attributes Show updated_by attributes object | null
-
profile_uid string
-
-
401 application/json; Elastic-Api-Version=2023-10-31
Authorization information is missing or invalid.
Hide response attributes Show response attributes object
-
error string
-
message string
-
statusCode integer
-
curl \
-X PATCH https://localhost:5601/api/cases \
-H "Content-Type: application/json; Elastic-Api-Version=2023-10-31" \
-H "kbn-xsrf: string"
{
"cases": [
{
"id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2",
"tags": [
"tag-1"
],
"version": "WzIzLDFd",
"settings": {
"syncAlerts": true
},
"connector": {
"id": "131d4448-abe0-4789-939d-8ef60680b498",
"name": "My connector",
"type": ".jira",
"fields": {
"parent": null,
"priority": null,
"issueType": "10006"
}
},
"description": "A case description.",
"customFields": [
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": false
},
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "My new field value"
}
]
}
]
}
[
{
"id": "66b9aa00-94fa-11ea-9f74-e7e108796192",
"tags": [
"tag-1"
],
"owner": "cases",
"title": "Case title 1",
"status": "open",
"version": "WzU0OCwxXQ==",
"category": null,
"comments": [],
"duration": null,
"settings": {
"syncAlerts": true
},
"severity": "low",
"assignees": [],
"closed_at": null,
"closed_by": null,
"connector": {
"id": "131d4448-abe0-4789-939d-8ef60680b498",
"name": "My connector",
"type": ".jira",
"fields": {
"parent": null,
"priority": null,
"issueType": "10006"
}
},
"created_at": "2023-10-13T09:16:17.416Z",
"created_by": {
"email": null,
"username": "elastic",
"full_name": null,
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
},
"updated_at": "2023-10-13T09:48:33.043Z",
"updated_by": {
"email": null,
"username": "elastic",
"full_name": null,
"profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
},
"description": "A case description.",
"totalAlerts": 0,
"customFields": [
{
"key": "d312efda-ec2b-42ec-9e2c-84981795c581",
"type": "text",
"value": "My new field value"
},
{
"key": "fcc6840d-eb14-42df-8aaf-232201a705ec",
"type": "toggle",
"value": false
}
],
"totalComment": 0,
"external_service": {
"pushed_at": "2023-10-13T09:20:40.672Z",
"pushed_by": {
"email": null,
"username": "elastic",
"full_name": null
},
"external_id": "10003",
"connector_id": "05da469f-1fde-4058-99a3-91e4807e2de8",
"external_url": "https://hms.atlassian.net/browse/IS-4",
"connector_name": "Jira",
"external_title": "IS-4"
}
}
]
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}