IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Actions API (for pushing cases to external systems)edit
This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
You can use the Actions API to open and update cases in external ticketing systems. This requires creating a connector, which stores the information required to interface with the external system.
To send cases to an external system and keep the SIEM UI updated:
- Create connector: Create the connector (Actions API).
- Set connector or Update case configurations: If required, configure connector options (Cases API).
- Create or update an external incident: Send the case to an external system (Actions API). You must store the returned data as it is required for updating the the SIEM case.
- Add external details to case: Update the SIEM case with the associated external system data returned in step 3 (Cases API).
- Repeat step 3 and step 4 each time you open or update a case.