The SIEM app is now a part of the Elastic Security solution. Click here to view SIEM documentation for previous releases.
« Set default Elastic Security UI connector Get current connector »
Elastic Docs ›Elastic Security Solution [7.9] ›Elastic Security APIs ›Cases API

Update case configurations

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Update case configurations

edit

Updates the connector’s case closure settings.

Connectors are used to interface with external systems. You can only call this method after you have created a connector (see Create connector). After a connector has been created and assigned, call Create or update an external incident to send cases to the external system.

Request URL

edit

PATCH <kibana host>:<port>/api/cases/configure

Request body

edit

A JSON object with these fields:

Name Type Description Required

connector_id

String

The ID of the connector you want to use for sending cases to external systems.

Yes

connector_name

String

The connector name.

No

closure_type

String

Determines whether a case is automatically closed in Elastic Security when it is pushed to external systems. Valid values are:

  • close-by-pushing: Elastic Security cases are automatically closed when they are pushed.
  • close-by-user: Elastic Security cases are not automatically closed.

No

version

String

The connector version.

Yes

Call Get current connector to retrieve the version value, and Find connectors to retrieve connector IDs.

Example request

edit

Changes the connector’s case closure option:

PATCH api/cases/configure
{
  "connector_id": "131d4448-abe0-4789-939d-8ef60680b498",
  "closure_type": "close-by-pushing",
  "version": "WzIwMiwxXQ=="
}

Response code

edit
200
Indicates a successful call.

Example response

edit
{
  "connector_id": "131d4448-abe0-4789-939d-8ef60680b498",
  "closure_type": "close-by-pushing",
  "connector_name": "ServiceNow",
  "created_at": "2020-03-30T13:31:38.083Z",
  "created_by": {
    "email": "admin@hms.gov.uk",
    "full_name": "Ms Admin",
    "username": "admin"
  },
  "updated_at": "2020-03-31T06:21:35.759Z",
  "updated_by": {
    "email": "admin@hms.gov.uk",
    "full_name": "Ms Admin",
    "username": "admin"
  },
  "version": "WzIwMywxXQ=="
}
« Set default Elastic Security UI connector Get current connector »