Type to search.

Push a case to an external service

Base URL
https://{kibana_url}
Auth

You must have all privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges. You must also have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're pushing.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

caseId string required

The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.

Example: 9c235210-6834-11ea-a78c-6ffb38a34414
connectorId string required

An identifier for the connector. To retrieve connector IDs, use the find connectors API.

Example: abed3a70-71bd-11ea-a0b2-c51ea50a58e2

Header parameters

kbn-xsrf string required

Cross-site request forgery protection

Request body

Type: object

Responses

Indicates a successful call.

application/json
category string nullable

The case category.

closed_at string · format: date-time required nullable
closed_by object required nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
comments union oneOf[] · max items: 10000 required

An array of comment objects for the case.

One of:
type enum required
Values: alert
alertId string[]
created_at string · format: date-time
id string
index string[]
owner enum

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
pushed_at string · format: date-time nullable
updated_at string · format: date-time nullable
version string
connector union oneOf required
One of: (determined by type)
type: .none

Defines properties for connectors when type is .none.

type enum required

The type of connector. To create a case without a connector, use .none. To update a case to remove the connector, specify .none.

Values: .none
fields string required nullable

An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.

id string required

The identifier for the connector. To create a case without a connector, use none. To update a case to remove the connector, specify none.

name string required

The name of the connector. To create a case without a connector, use none. To update a case to remove the connector, specify none.

created_at string · format: date-time required
created_by object required
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
description string required
duration integer required nullable

The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.

external_service object required nullable
connector_id string
connector_name string
external_id string
external_title string
external_url string
pushed_at string · format: date-time
id string required
owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
settings object required

An object that contains the case settings.

syncAlerts boolean required

Turns alert syncing on or off.

severity enum · default: low required

The severity of the case.

Values: critical high low medium
status enum required

The status of the case.

Values: closed in-progress open
tags string[] required
title string required
totalAlerts integer required
totalComment integer required
updated_at string · format: date-time required nullable
updated_by object required nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
version string required