stack kb cases update-case-template cli command
Auth required
Idempotent
Scope: global
elastic stack kb cases update-case-template \
--template-id <template-id> \
--definition <definition> \
--owner <owner> \
[options]
Update a case template
--template-idstringrequired- The identifier for the template.
--definitionstringrequired- The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a
fieldsarray of inline field definitions or$refentries pointing into the owner's field library. Stored field values appear on cases underextended_fieldskeys shaped<field_name>_as_<storage_type>. --ownerenumrequired-
Values: cases, observability, securitySolution
--dry-run- When true, validates the request without updating the template and returns
{"valid": true}. --descriptionstring- A description of the template.
--is-enabled- Disabled templates are hidden from the case creation flow.
--namestring- The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (
name:), which is then used as the identity name. -
Repeatable: pass
--tagsmultiple times to supply more than one value --input-filestring- path to a JSON file to use as command input
--json-
output as JSON