Set connectoredit

Sets the default connector in the SIEM UI.

Connectors are used to interface with external systems. You can only call this method after you have created a connector (see Create connector). After a connector has been created and assigned, call Create or update an external incident to send cases to the external system.

Request URLedit

POST <kibana host>:<port>/api/cases/configure

Request bodyedit

A JSON object with these fields:

Name Type Description Required

connector_id

String

The connector ID.

Yes

connector_name

String

The connector name.

Yes

closure_type

String

Determines whether a case is automatically closed in the SIEM app when it is pushed to ServiceNow. Valid values are:

  • close-by-pushing: SIEM app cases are automatically closed when they are pushed to ServiceNow.
  • close-by-user: SIEM app cases are not automatically closed.

Yes

Call Find connectors to retrieve connector IDs and names.

Example requestedit

POST api/cases/configure
{
  "connector_id": "61787f53-4eee-4741-8df6-8fe84fa616f7",
  "closure_type": "close-by-user",
  "connector_name": "ServiceNow"
}

Response codeedit

200
Indicates a successful call.

Example responseedit

{
  "connector_id": "61787f53-4eee-4741-8df6-8fe84fa616f7",
  "closure_type": "close-by-user",
  "connector_name": "ServiceNow",
  "created_at": "2020-03-30T13:31:38.083Z",
  "created_by": {
    "email": "moneypenny@hms.gov.uk",
    "full_name": "Ms Moneypenny",
    "username": "moneypenny"
  },
  "updated_at": null,
  "updated_by": null,
  "version": "WzE3NywxXQ=="
}