IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Add commentedit
Adds a comment to an existing case.
Request URLedit
POST <kibana host>:<port>/api/cases/<case ID>/comments
URL partsedit
The URL must include the case ID of the case to which you are adding a
comment. Call Find cases to retrieve case IDs.
Request bodyedit
A JSON object with a comment field:
| Name | Type | Description | Required |
|---|---|---|---|
|
String |
The comment type, which can be |
Yes |
|
String |
The case’s new comment. |
Yes, only when type is |
|
String |
The alert id. |
Yes, only when type is |
|
String |
The alert index. |
Yes, only when type is |
Only alerts (signals) of Elastic Security are supported.
Example requestedit
Adds a comment to case ID 293f1bc0-74f6-11ea-b83a-553aecdb28b6:
POST api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/comments
{
"type": "user",
"comment": "That is nothing - Ethan Hunt answered a targeted social
media campaign promoting phishy pension schemes to IMF operatives."
}
Response codeedit
-
200 - Indicates a successful call.
Response payloadedit
The updated JSON case object with the new comment, the user who created the comment, and the comment’s ID, version, and creation time.
Example responseedit
"id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
"version": "WzIwNDMyLDFd",
"comments": [
{
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
"version": "WzIwNDMxLDFd",
"type": "user",
"comment": "That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives.",
"created_at": "2020-04-02T15:28:03.034Z",
"created_by": {
"email": "moneypenny@hms.gov.uk",
"full_name": "Ms Moneypenny",
"username": "moneypenny"
},
"pushed_at": null,
"pushed_by": null,
"updated_at": null,
"updated_by": null
}
],
"totalComment": 1,
"title": "This case will self-destruct in 5 seconds",
"tags": [
"phishing",
"social engineering"
],
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.",
"closed_at": null,
"closed_by": null,
"created_at": "2020-04-02T15:25:19.088Z",
"created_by": {
"email": "ahunley@imf.usa.gov",
"full_name": "Alan Hunley",
"username": "ahunley"
},
"external_service": null,
"status": "open",
"updated_at": "2020-04-02T15:28:03.034Z",
"updated_by": {
"email": "moneypenny@hms.gov.uk",
"full_name": "Ms Moneypenny",
"username": "moneypenny"
}
}