stack kb cases create-case cli command

elastic stack kb cases create-case \
  --connector <connector> \
  --description <description> \
  --owner <owner> \
  --settings <settings> \
  --tags <tags> \
  --title <title> \
  [options]

Create a case

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--connector string required

--description string required

--owner enum required

Values: cases, observability, securitySolution

--settings string required

--tags string[] required

Repeatable: pass --tags multiple times to supply more than one value

--title string required

--assignees string[]

Repeatable: pass --assignees multiple times to supply more than one value

--category string

--custom-fields string[]

Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.

Repeatable: pass --custom-fields multiple times to supply more than one value

--extended-fields string

--severity enum

Values: critical, high, low, medium

--template string

A case template to create the case from. Requires the xpack.cases.templates.enabled setting. The server applies the template's case defaults (severity, category, tags, assignees, settings, connector) and its field defaults into extended_fields; any value explicitly provided in the request wins over the template default. When version is omitted, the latest version of the template is resolved and pinned on the case. To discover a template's fields before creating a case, use the get case fields API (GET /api/cases/fields).

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON