Sign in
cases

Add case settings

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>

Refer to Spaces for more information.

Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where you are creating cases.

post/api/cases/configure

Headers

kbn-xsrfstring required

Cross-site request forgery protection

Request body

closure_type'close-by-pushing' | 'close-by-user' required

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

extractObservablesboolean

Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events. When omitted, defaults to the owner's default: true for Security, false for Stack and Observability. For owners that do not support observable extraction (currently Observability), setting this to true has no effect on case creation; new cases for those owners always use false.

owner'cases' | 'observability' | 'securitySolution' required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Example request

{
  "closure_type": "close-by-user",
  "connector": {
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
          }
        ],
        "connector": {
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "settings": {
          "extractObservables": true,
          "syncAlerts": true
        }
      }
    }
  ]
}

Response

Indicates a successful call.

closure_type'close-by-pushing' | 'close-by-user'

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

created_atstring date-time
errorstring nullable
extractObservablesboolean

Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.

idstring
owner'cases' | 'observability' | 'securitySolution'

The application that owns the cases: Stack Management, Observability, or Elastic Security.

updated_atstring date-time nullable
versionstring

Example response

{
  "closure_type": "close-by-user",
  "connector": {
    "id": "none",
    "name": "none",
    "type": ".none"
  },
  "created_at": "2022-06-01T17:07:17.767Z",
  "created_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "extractObservables": true,
  "id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
  "mappings": [
    {
      "action_type": "overwrite",
      "source": "title",
      "target": "summary"
    }
  ],
  "observableTypes": [
    {
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "label": "My observable type"
    }
  ],
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0"
          }
        ],
        "connector": {
          "id": "none",
          "name": "none",
          "type": ".none"
        },
        "settings": {
          "extractObservables": true,
          "syncAlerts": true
        }
      }
    }
  ],
  "updated_at": "2022-06-01T19:58:48.169Z",
  "updated_by": {
    "profile_uid": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
    "username": "elastic"
  },
  "version": "WzIwNzMsMV0="
}

Changes

No changes recorded. 20 of the 176 revisions have no diff computed, so they could not be searched.