A newer version is available. For the latest information, see the current release documentation.
« Create connector Create or update an external incident »
Elastic Docs ›SIEM Guide [7.7] ›SIEM APIs ›Actions API (for pushing cases to external systems)

Update connector

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Update connector

edit

Updates a ServiceNow connector.

Request URL

edit

PUT <kibana host>:<port>/api/action/<connector ID>

URL parts

edit

The URL must include the connector ID of the connector you are updating. Call Find connectors to retrieve connector IDs.

Request body

edit

A JSON object with the fields you want to update:

Name Type Description Required

config

config

Object containing the action’s configuration.

Yes

secrets

Object

Object containing the ServiceNow account credentials used to create and update incidents:

  • username (string): The account username.
  • password (string): The account password.

Yes

name

String

The registered ServiceNow connector.

Yes

config schema

Name Type Description Required

casesConfiguration

Object

Contains a mapping array, which determines how SIEM case fields are mapped to ServiceNow incident fields:

  • source (string): The name of the SIEM case field, which can be title, description, or comments.
  • target (string): The name of the mapped ServiceNow incident field. For example: short_description, description, and comments.
  • actionType (string): Determines whether SIEM case updates overwrite or append to the mapped ServiceNow incident fields. Valid values are overwrite and append.

Yes

apiUrl

String

URL of the ServiceNow instance.

Yes

Example request

edit

Updates the description field mapping of connector ID 61787f53-4eee-4741-8df6-8fe84fa616f7:

PUT api/action/61787f53-4eee-4741-8df6-8fe84fa616f7
{
  "name": "ServiceNow",
  "config": {
    "apiUrl": "https://dev78437.service-now.com",
    "casesConfiguration": {
      "mapping": [
        {
          "source": "title",
          "target": "short_description",
          "actionType": "overwrite"
        },
        {
          "source": "description",
          "target": "description",
          "actionType": "append"
        },
        {
          "source": "comments",
          "target": "comments",
          "actionType": "append"
        }
      ]
    }
  },
  "secrets": {
    "username": "admin",
    "password": "securePassword123!"
  }
}

Response code

edit
200
Indicates a successful call.

Response payload

edit

The updated JSON connector object.

Example response

edit
{
  "id": "61787f53-4eee-4741-8df6-8fe84fa616f7",
  "actionTypeId": ".servicenow",
  "name": "ServiceNow",
  "config": {
    "apiUrl": "https://dev78437.service-now.com",
    "casesConfiguration": {
      "mapping": [
        {
          "source": "title",
          "target": "short_description",
          "actionType": "overwrite"
        },
        {
          "source": "description",
          "target": "description",
          "actionType": "append"
        },
        {
          "source": "comments",
          "target": "comments",
          "actionType": "append"
        }
      ]
    }
  }
}
« Create connector Create or update an external incident »