IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Actions API (for pushing cases to external systems) Update connector »
Elastic Docs ›Elastic Security Solution [7.13] ›Elastic Security APIs ›Actions API (for pushing cases to external systems)

Create connector

edit

Create connector

edit

Creates a connector, which can then be used to open and update cases in external systems.

The Kibana Console supports only Elasticsearch APIs. You cannot interact with the Kibana APIs with the Console and must use curl or another HTTP tool instead. For more information, refer to Console.

Request URL

edit

POST <kibana host>:<port>/api/actions/action

Request body

edit

A JSON object with these fields:

Name Type Description Required

actionTypeId

String

Must be one of these:

  • .servicenow: Send cases to ServiceNow
  • .jira: Send cases to Jira
  • .resilient Send cases to IBM Resilient

Yes

config

config

Object containing the action’s configuration.

Yes

secrets

Object

Object containing the third-party account information used to create and update incidents.

For ServiceNow connectors:

  • username (string): The account username.
  • password (string): The account password.

For Jira connectors:

  • email (string): The account email.
  • apiToken (string): Jira API authentication token.

For IBM Resilient connectors:

  • apiKeyId (string): The authentication key ID.
  • apiKeySecret (string): The authentication key secret.

Yes

name

String

The connector’s name.

Yes

config schema

Name Type Description Required

apiUrl

String

URL of the third-party instance.

Yes

projectKey

String

Jira project key.

For Jira connectors, yes. For other connectors, no.

orgId

String

IBM Resilient organization ID.

For IBM Resilient connectors, yes. For other connectors, no.

Example requests

edit

Creates a ServiceNow connector:

POST api/actions/action
{
  "actionTypeId": ".servicenow",
  "config": {
    "apiUrl": "https://dev87359.service-now.com",
  },
  "secrets": {
    "username": "admin",
    "password": "securePassword123!"
  },
  "name": "ServiceNow"
}

Creates a Jira connector:

POST api/actions/action
{
  "actionTypeId": ".jira",
  "config": {
    "apiUrl": "https://hms.atlassian.net",
    "projectKey": "HMS"
  },
  "secrets": {
    "email": "admin@hms.gov.co.uk",
    "apiToken": "my-api-token"
  },
  "name": "Jira"
}

Creates an IBM Resilient connector:

POST api/actions/action
{
  "actionTypeId": ".resilient",
  "config": {
    "apiUrl": "https://ibm-resilient.siem.estc.dev",
    "orgId": "201"
  },
  "secrets": {
    "apiKeyId": "2ad2bbd3-7cd2-3096-9619-de13c5ab70ca",
    "apiKeySecret": "Hzol67ZoeATAR-8pQxSp3q_NPTDtWU6_QNBoCSCA-ic"
  },
  "name": "IBM"
}

Response code

edit
200
Indicates a successful call.

Response payload

edit

A JSON object with a connector id that is required to push cases to ServiceNow.

Example response

edit

ServiceNow connector:

{
  "id": "f07a60c7-a340-4cb1-93b8-1f5e35dc56b1",
  "actionTypeId": ".servicenow",
  "name": "SN API 2",
  "config": {
    "apiUrl": "https://dev185413.service-now.com",
  },
  "isPreconfigured": false
}
« Actions API (for pushing cases to external systems) Update connector »