Cases

Create Case Related Event

Attach a related event to an existing case.

post/connect/case/events/

Request body

acknowledgedboolean

Whether to attach events that are already acknowledged: true = act on acknowledged events, false = act on unacknowledged events

caseIdstring required

The case ID for which this related event is to be attached, or is already attached.

dateRangestring

The date range to use for searching for matching events

dateRangeFormatstring

The date range format. If unsure how to use this then use the example value exactly as shown.

escalatedboolean

Whether to attach events that are already escalated to a case: true = act on escalated events, false = act on unescalated events

fieldsobject required

A mapping of related event field names and their values.

timezonestring

The timezone to use with the date range

Example request

{
  "acknowledged": true,
  "caseId": "PdFc-JIBLkNJ8-bDfz47",
  "dateRange": "2024/12/03 02:31:35 PM - 2024/12/04 02:31:35 PM",
  "dateRangeFormat": "2006/01/02 3:04:05 PM",
  "fields": {
    "client.ip": "1.2.3.4",
    "client.port": "1099"
  },
  "timezone": "America/New_York"
}

Response

Returns the bulk operation response

countinteger

The count of detections that were submitted to be updated or deleted in bulk

Example response

{
  "count": 120
}

Changes

Changed in 3 of the 23 revisions of this API.21113

Feb 6, 2025b162e07f42a62See the full diff
- ○
  added the new optional request property acknowledged
  new-optional-request-property
- ○
  added the new optional request property escalated
  new-optional-request-property
Feb 5, 2025d99c966f2c5e164See the full diff
- ▲
  removed the success response with the status 200
  response-success-status-removed
- ●
  removed the request property createTime
  request-property-removed
- ●
  removed the request property id
  request-property-removed
- ●
  removed the request property kind
  request-property-removed
- ●
  removed the request property operation
  request-property-removed
- ●
  removed the request property updateTime
  request-property-removed
- ●
  removed the request property userId
  request-property-removed
- ○
  added the new optional request property dateRange
  new-optional-request-property
- ○
  added the new optional request property dateRangeFormat
  new-optional-request-property
- ○
  added the new optional request property timezone
  new-optional-request-property
- ○
  added the success response with the status 202
  response-success-status-added
This revision also has 12 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Dec 10, 2024ee1120fd1e20157See the full diff
- ▲
  removed the success response with the status 202
  response-success-status-removed
- ●
  removed the request property acknowledged
  request-property-removed
- ●
  removed the request property dateRange
  request-property-removed
- ●
  removed the request property dateRangeFormat
  request-property-removed
- ●
  removed the request property escalated
  request-property-removed
- ●
  removed the request property timezone
  request-property-removed
- ○
  added the new optional request property createTime
  new-optional-request-property
- ○
  added the new optional request property id
  new-optional-request-property
- ○
  added the new optional request property kind
  new-optional-request-property
- ○
  added the new optional request property operation
  new-optional-request-property
- ○
  added the new optional request property updateTime
  new-optional-request-property
- ○
  added the new optional request property userId
  new-optional-request-property
- ○
  added the success response with the status 200
  response-success-status-added
This revision also has 35 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history