cases

Add case settings

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>

Refer to Spaces for more information.

Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where you are creating cases.

post/api/cases/configure

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/cases/configure
  • Auth
    • API key in header Authorization
    • or HTTP basic

Headers

kbn-xsrfstring required

Cross-site request forgery protection

Request body

closure_type'close-by-pushing' | 'close-by-user' required

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

extractObservablesboolean

Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events. When omitted, defaults to the owner's default: true for Security, false for Stack and Observability. For owners that do not support observable extraction (currently Observability), setting this to true has no effect on case creation; new cases for those owners always use false.

owner'cases' | 'observability' | 'securitySolution' required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

workflowTagsstring[]

Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Example request

{
  "closure_type": "close-by-user",
  "connector": {
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
          }
        ],
        "connector": {
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "settings": {
          "extractObservables": true,
          "syncAlerts": true
        }
      }
    }
  ]
}

Response

Indicates a successful call.

closure_type'close-by-pushing' | 'close-by-user'

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

created_atstring date-time
errorstring nullable
extractObservablesboolean

Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.

idstring
owner'cases' | 'observability' | 'securitySolution'

The application that owns the cases: Stack Management, Observability, or Elastic Security.

updated_atstring date-time nullable
versionstring
workflowTagsstring[]

Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Example response

{
  "closure_type": "close-by-user",
  "connector": {
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "created_at": "2022-06-01T17:07:17.767Z",
  "created_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "extractObservables": true,
  "id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
  "mappings": [
    {
      "action_type": "overwrite",
      "source": "title",
      "target": "summary"
    }
  ],
  "observableTypes": [
    {
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "label": "My observable type"
    }
  ],
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
          }
        ],
        "connector": {
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "settings": {
          "extractObservables": true,
          "syncAlerts": true
        }
      }
    }
  ],
  "updated_at": "2022-06-01T19:58:48.169Z",
  "updated_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "version": "WzIwNzMsMV0="
}

Changes

No operation changes recorded.