---
title: "Create Case Related Event"
method: POST
path: "/connect/case/events/"
tags: ["Cases"]
---

# Create Case Related Event

`POST /connect/case/events/`

Attach a related event to an existing case.

## Request body

- ModelAttachEventCriteria
  - `acknowledged` boolean — Whether to attach events that are already acknowledged: true = act on acknowledged events, false = act on unacknowledged events
  - `caseId` string, required — The case ID for which this related event is to be attached, or is already attached.
  - `dateRange` string — The date range to use for searching for matching events
  - `dateRangeFormat` string — The date range format. If unsure how to use this then use the example value exactly as shown.
  - `escalated` boolean — Whether to attach events that are already escalated to a case: true = act on escalated events, false = act on unescalated events
  - `fields` object, required — A mapping of related event field names and their values.
  - `timezone` string — The timezone to use with the date range

## Response `202`

Returns the bulk operation response

- ServerBulkResp
  - `count` integer — The count of detections that were submitted to be updated or deleted in bulk

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `405` — Case module not configured on server
- `500` — Internal SOC error; review SOC logs

## Changes

- **2025-02-06** `b162e07f42a6` — 2 info
  - added the new optional request property `acknowledged`
  - added the new optional request property `escalated`
- **2025-02-05** `d99c966f2c5e` — 1 breaking, 6 warning, 4 info
  - removed the success response with the status `200`
  - removed the request property `createTime`
  - removed the request property `id`
  - removed the request property `kind`
  - …7 more
- **2024-12-10** `ee1120fd1e20` — 1 breaking, 5 warning, 7 info
  - removed the success response with the status `202`
  - removed the request property `acknowledged`
  - removed the request property `dateRange`
  - removed the request property `dateRangeFormat`
  - …9 more

[Change history](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api/changes/connect/case/events/post.md)

---

[API](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/revisions/0576ce393f8d/schema)