The SIEM app is now a part of the Elastic Security solution. Click here to view the current documentation.
IMPORTANT: No additional bug fixes or documentation updates will be released for this version.
Elastic Docs ›SIEM Guide [7.8] ›SIEM APIs ›Actions API (for pushing cases to external systems)
« Create connector Create or update an external incident »

Update connectoredit

Updates a connector.

Request URLedit

PUT <kibana host>:<port>/api/action/<connector ID>

URL partsedit

The URL must include the connector ID of the connector you are updating. Call Find connectors to retrieve connector IDs.

Request bodyedit

A JSON object with the fields you want to update:

Name Type Description Required

config

config

Object containing the action’s configuration.

Yes

secrets

Object

Object containing the third-party account information used to create and update incidents.

For ServiceNow connectors:

  • username (string): The account username.
  • password (string): The account password.

For Jira connectors:

  • email (string): The account email.
  • apiToken (string): Jira API authentication token.

Yes

name

String

The registered ServiceNow connector.

Yes

config schema

Name Type Description Required

casesConfiguration

Object

Contains a mapping array, which determines how SIEM case fields are mapped to ServiceNow incident fields:

  • source (string): The name of the SIEM case field, which can be title, description, or comments.
  • target (string): The name of the mapped exterals field. For example: short_description (ServiceNow), title (Jira), description, and comments.
  • actionType (string): Determines whether SIEM case updates overwrite or append to the mapped fields. Valid values are overwrite and append.

Yes

apiUrl

String

URL of the third-party instance.

Yes

projectKey

String

Jira project key.

For Jira connectors, yes. For ServiceNow connectors, no.

Example requestedit

Updates the description field mapping of connector ID 61787f53-4eee-4741-8df6-8fe84fa616f7:

PUT api/action/61787f53-4eee-4741-8df6-8fe84fa616f7
{
  "name": "ServiceNow",
  "config": {
    "apiUrl": "https://dev78437.service-now.com",
    "casesConfiguration": {
      "mapping": [
        {
          "source": "title",
          "target": "short_description",
          "actionType": "overwrite"
        },
        {
          "source": "description",
          "target": "description",
          "actionType": "append"
        },
        {
          "source": "comments",
          "target": "comments",
          "actionType": "append"
        }
      ]
    }
  },
  "secrets": {
    "username": "admin",
    "password": "securePassword123!"
  }
}

Response codeedit

200
Indicates a successful call.

Response payloadedit

The updated JSON connector object.

Example responseedit

{
  "id": "61787f53-4eee-4741-8df6-8fe84fa616f7",
  "actionTypeId": ".servicenow",
  "name": "ServiceNow",
  "config": {
    "apiUrl": "https://dev78437.service-now.com",
    "casesConfiguration": {
      "mapping": [
        {
          "source": "title",
          "target": "short_description",
          "actionType": "overwrite"
        },
        {
          "source": "description",
          "target": "description",
          "actionType": "append"
        },
        {
          "source": "comments",
          "target": "comments",
          "actionType": "append"
        }
      ]
    }
  }
}
« Create connector Create or update an external incident »