Create connector
editCreate connector
editCreates a connector, which can then be used to open and update cases in external systems.
Request URL
editPOST <kibana host>:<port>/api/actions/action
Request body
editA JSON object with these fields:
Name | Type | Description | Required |
---|---|---|---|
|
String |
Must be one of these:
|
Yes |
|
Object containing the action’s configuration. |
Yes |
|
|
Object |
Object containing the third-party account information used to create and update incidents. For ServiceNow connectors:
For Jira connectors:
For IBM Resilient connectors:
|
Yes |
|
String |
The connector’s name. |
Yes |
Name | Type | Description | Required |
---|---|---|---|
|
String |
URL of the third-party instance. |
Yes |
|
String |
Jira project key. |
For Jira connectors, yes. For other connectors, no. |
|
String |
IBM Resilient organization ID. |
For IBM Resilient connectors, yes. For other connectors, no. |
Example requests
editCreates a ServiceNow connector:
POST api/actions/action { "actionTypeId": ".servicenow", "config": { "apiUrl": "https://dev87359.service-now.com", }, "secrets": { "username": "admin", "password": "securePassword123!" }, "name": "ServiceNow" }
Creates a Jira connector:
POST api/actions/action { "actionTypeId": ".jira", "config": { "apiUrl": "https://hms.atlassian.net", "projectKey": "HMS" }, "secrets": { "email": "admin@hms.gov.co.uk", "apiToken": "my-api-token" }, "name": "Jira" }
Creates an IBM Resilient connector:
POST api/actions/action { "actionTypeId": ".resilient", "config": { "apiUrl": "https://ibm-resilient.siem.estc.dev", "orgId": "201" }, "secrets": { "apiKeyId": "2ad2bbd3-7cd2-3096-9619-de13c5ab70ca", "apiKeySecret": "Hzol67ZoeATAR-8pQxSp3q_NPTDtWU6_QNBoCSCA-ic" }, "name": "IBM" }
Response code
edit-
200
- Indicates a successful call.
Response payload
editA JSON object with a connector id
that is required to push cases to ServiceNow.
Example response
editServiceNow connector:
{ "id": "f07a60c7-a340-4cb1-93b8-1f5e35dc56b1", "actionTypeId": ".servicenow", "name": "SN API 2", "config": { "apiUrl": "https://dev185413.service-now.com", }, "isPreconfigured": false }