Add commentedit
Adds a comment to an existing case.
The Kibana Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl
or another HTTP tool instead. For more information, refer to Console.
Request URLedit
POST <kibana host>:<port>/api/cases/<case ID>/comments
URL partsedit
The URL must include the case ID
of the case to which you are adding a
comment. Call Find cases to retrieve case IDs.
Request bodyedit
A JSON object with a comment
field:
Name | Type | Description | Required |
---|---|---|---|
|
String |
The comment type, which can be |
Yes |
|
String |
The case’s new comment. |
Yes, only when type is |
|
String |
The alert id. |
Yes, only when type is |
|
String |
The alert index. |
Yes, only when type is |
Only alerts (signals) of Elastic Security are supported.
Example requestedit
Adds a comment to case ID 293f1bc0-74f6-11ea-b83a-553aecdb28b6
:
POST api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/comments { "type": "user", "comment": "That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives.", "owner": "securitySolution" }
Response codeedit
-
200
- Indicates a successful call.
Response payloadedit
The updated JSON case object with the new comment, the user who created the comment, and the comment’s ID, version, and creation time.
Example responseedit
"id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6", "version": "WzIwNDMyLDFd", "comments": [ { "id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6", "version": "WzIwNDMxLDFd", "type": "user", "comment": "That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives.", "created_at": "2020-04-02T15:28:03.034Z", "created_by": { "email": "moneypenny@hms.gov.uk", "full_name": "Ms Moneypenny", "username": "moneypenny" }, "pushed_at": null, "pushed_by": null, "updated_at": null, "updated_by": null } ], "totalComment": 1, "title": "This case will self-destruct in 5 seconds", "tags": [ "phishing", "social engineering" ], "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.", "closed_at": null, "closed_by": null, "created_at": "2020-04-02T15:25:19.088Z", "created_by": { "email": "ahunley@imf.usa.gov", "full_name": "Alan Hunley", "username": "ahunley" }, "external_service": null, "owner": "securitySolution", "status": "open", "updated_at": "2020-04-02T15:28:03.034Z", "updated_by": { "email": "moneypenny@hms.gov.uk", "full_name": "Ms Moneypenny", "username": "moneypenny" } }