cases

Get case settings

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>

Refer to Spaces for more information.

Get setting details such as the closure type, custom fields, templates, and the default connector for cases. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where the cases were created.

get/api/cases/configure

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/cases/configure
  • Auth
    • API key in header Authorization
    • or HTTP basic

Query parameters

'cases' | 'observability' | 'securitySolution'

The application that owns the cases: Stack Management, Observability, or Elastic Security.

OR
CasesOwner[]
Example:cases

A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.

Response

Indicates a successful call.

closure_type'close-by-pushing' | 'close-by-user'

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

created_atstring date-time
errorstring nullable
extractObservablesboolean

Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.

idstring
owner'cases' | 'observability' | 'securitySolution'

The application that owns the cases: Stack Management, Observability, or Elastic Security.

updated_atstring date-time nullable
versionstring
workflowTagsstring[]

Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Example response

[
  {
    "closure_type": "close-by-user",
    "connector": {
      "id": "none",
      "name": "none",
      "type": ".none"
    },
    "created_at": "2022-06-01T17:07:17.767Z",
    "created_by": {
      "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
      "username": "elastic"
    },
    "extractObservables": true,
    "id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
    "mappings": [
      {
        "action_type": "overwrite",
        "source": "title",
        "target": "summary"
      }
    ],
    "observableTypes": [
      {
        "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
        "label": "My observable type"
      }
    ],
    "owner": "cases",
    "templates": [
      {
        "caseFields": {
          "assignees": [
            {
              "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
            }
          ],
          "connector": {
            "id": "none",
            "name": "none",
            "type": ".none"
          },
          "settings": {
            "extractObservables": true,
            "syncAlerts": true
          }
        }
      }
    ],
    "updated_at": "2022-06-01T19:58:48.169Z",
    "updated_by": {
      "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
      "username": "elastic"
    },
    "version": "WzIwNzMsMV0="
  }
]

Changes

No operation changes recorded.