IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Elastic Security Solution [7.14] ›Elastic Security APIs ›Actions API (for pushing cases to external systems)
« Create connector Create or update an external incident »

Update connectoredit

Updates a connector.

The Kibana Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl or another HTTP tool instead. For more information, refer to Console.

Request URLedit

PUT <kibana host>:<port>/api/actions/connector/<connector ID>

URL partsedit

The URL must include the connector ID of the connector you are updating. Call Find connectors to retrieve connector IDs.

Request bodyedit

A JSON object with the fields you want to update:

Name Type Description Required

config

config

Object containing the action’s configuration.

Yes

secrets

Object

Object containing the third-party account information used to create and update incidents.

For ServiceNow connectors:

  • username (string): The account username.
  • password (string): The account password.

For Jira connectors:

  • email (string): The account email.
  • apiToken (string): Jira API authentication token.

For IBM Resilient connectors:

  • apiKeyId (string): The authentication key ID.
  • apiKeySecret (string): The authentication key secret.

For Swimlane connectors:

  • apiToken (string): Swimlane API authentication token.

Yes

name

String

The connector’s name.

Yes

config schema

Name Type Description Required

apiUrl

String

URL of the third-party instance.

Yes

connectorType

String

The type of the connector.

Must be one of these:

  • all
  • alerts
  • cases

For Swimlane connectors, yes. For other connectors, no.

mappings

Object

The field mapping.

Must be:

  • alertIdConfig (Object): Mapping for the alert ID.
  • caseIdConfig (Object): Mapping for the case ID.
  • caseNameConfig (Object): Mapping for the case name.
  • commentsConfig (Object): Mapping for the case comments.
  • ruleNameConfig (Object): Mapping for the name of the alert’s rule.
  • severityConfig (Object): Mapping for the severity.
  • descriptionConfig (Object): Mapping for the case description.

The object of each attribute in the mappings must be:

  • id (string): The id of the field in Swimlane.
  • key (string): The key of the field in Swimlane.
  • name (string): The name of the field in Swimlane.
  • fieldType (Object): The type of the field in Swimlane.

For Swimlane connectors, yes. or other connectors, no.

projectKey

String

Jira project key.

For Jira connectors, yes. For other connectors, no.

orgId

String

IBM Resilient organization ID.

For IBM Resilient connectors, yes. For other connectors, no.

Example requestedit

Updates the description field mapping of connector ID 61787f53-4eee-4741-8df6-8fe84fa616f7:

PUT api/actions/connector/61787f53-4eee-4741-8df6-8fe84fa616f7
{
  "config": {
    "apiUrl": "https://dev357417.service-now.com",
        },
  "name": "SN API",
  "secrets": {
    "password": "stongpassword123!",
    "username": "admin"
  }
}

Response codeedit

200
Indicates a successful call.

Response payloadedit

The updated JSON connector object.

Example responseedit

{
  "id": "61787f53-4eee-4741-8df6-8fe84fa616f7",
  "connector_type_id": ".servicenow",
  "name": "ServiceNow",
  "config": {
    "apiUrl": "https://dev78437.service-now.com",
  }
}
« Create connector Create or update an external incident »