Update caseedit

Updates existing cases.

Request URLedit

PATCH <kibana host>:<port>/api/cases

Request bodyedit

A JSON array containing one or more case objects with updated field values:

Name Type Description Required

cases

cases[]

Array containing one or more case objects.

Yes

cases schemaedit

Name Type Description Required

id

String

The ID of the case being updated.

Yes

title

String

The updated case title.

No

connector_id

String

ID of the connector used for pushing case updates to external systems (returned when calling Find connectors).

No

description

String

The updated case description.

No

status

String

The updated case status, which can be:

  • open
  • closed

No

tags

String[]

The updated case tags.

No

version

String

The current case version (returned when calling Get case or Find cases).

Yes

Example requestedit

Updates the description, tags, and connector of case ID a18b38a0-71b0-11ea-a0b2-c51ea50a58e2:

PATCH api/cases
{
  "cases": [
    {
      "connector_id": "5b347c7b-6925-4452-a4dd-215550294ba2",
      "id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2",
      "description": "James Bond clicked on a highly suspicious email
      banner advertising cheap holidays for underpaid civil servants.
      Operation bubblegum is active. Repeat - operation bubblegum is
      now active!",
      "tags": [
        "phishing",
        "social engineering",
        "bubblegum"
      ],
      "version": "WzIzLDFd"
    }
  ]
}

Response codeedit

200
Indicates a successful call.

Response payloadedit

The updated case with a new version value.

Example responseedit

[
  {
    "id": "66b9aa00-94fa-11ea-9f74-e7e108796192",
    "version": "WzU0OCwxXQ==",
    "comments": [],
    "totalComment": 0,
    "connector_id": "5b347c7b-6925-4452-a4dd-215550294ba2",
    "title": "This case will self-destruct in 5 seconds",
    "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
    "tags": [
      "phishing",
      "social engineering",
      "bubblegum"
    ],
    "closed_at": null,
    "closed_by": null,
    "created_at": "2020-05-13T09:16:17.416Z",
    "created_by": {
      "email": "ahunley@imf.usa.gov",
      "full_name": "Alan Hunley",
      "username": "ahunley"
    },
    "external_service": {
      "external_title": "IS-4",
      "pushed_by": {
        "full_name": "Classified",
        "email": "classified@hms.oo.gov.uk",
        "username": "M"
      },
      "external_url": "https://hms.atlassian.net/browse/IS-4",
      "pushed_at": "2020-05-13T09:20:40.672Z",
      "connector_id": "05da469f-1fde-4058-99a3-91e4807e2de8",
      "external_id": "10003",
      "connector_name": "Jira"
    },
    "status": "open",
    "updated_at": "2020-05-13T09:48:33.043Z",
    "updated_by": {
      "email": "classified@hms.oo.gov.uk",
      "full_name": "Classified",
      "username": "M"
    }
  }
]