Update comment

edit

Updates an existing comment.

Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl or another HTTP tool instead. For more information, refer to Run Elasticsearch API requests.

Request URL

edit

PATCH <kibana host>:<port>/api/cases/<case ID>/comments

URL parts

edit

The URL must include the case ID of the comment’s associated case. Call Find cases to retrieve case IDs.

Request body

edit

A JSON object with the updated comment:

Name Type Description Required

type

String

The comment type, which can be user or alert.

Yes

comment

String

The updated comment.

Yes, only when type is user.

alertId

String

The updated alert ID.

Yes, only when type is alert.

index

String

The updated alert index.

Yes, only when type is alert.

id

String

The comment’s ID.

Yes

owner

String

The application that owns the case.

Yes

Must be a valid application owner that is registered within the case’s role-based access control system (i.e. securitySolution). The value must also match the owner field of the case this comment will be attached to.

version

String

The current comment version.

Yes

Call Get all case comments to retrieve comment IDs and version values.

The comment type and owner fields cannot be updated.

Example request

edit

Updates comment ID 8af6ac20-74f6-11ea-b83a-553aecdb28b6 (associated with case ID 293f1bc0-74f6-11ea-b83a-553aecdb28b6):

PATCH api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/comments
{
  "id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
  "type": "user",
  "comment": "That is nothing - Ethan Hunt answered a targeted social
  media campaign promoting phishy pension schemes to IMF operatives.
  Even worse, he likes baked beans.",
  "owner": "securitySolution",
  "version": "Wzk1LDFd"
}

Response code

edit
200
Indicates a successful call.

Response payload

edit

The updated JSON case object with the updated comment, the user who updated the comment, and the comment’s ID, version, and update time.

Example response

edit
{
  "id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
  "version": "WzIwNjM2LDFd",
  "comments": [
    {
      "id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
      "version": "WzIwNjM3LDFd",
      "type": "user",
      "comment": "That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives.",
      "created_at": "2020-04-02T15:28:03.034Z",
      "created_by": {
        "email": "moneypenny@hms.gov.uk",
        "full_name": "Ms Moneypenny",
        "username": "moneypenny"
      },
      "pushed_at": null,
      "pushed_by": null,
      "updated_at": "2020-04-02T15:34:01.118Z",
      "updated_by": {
        "email": "jbond@hms.gov.uk",
        "full_name": "James Bond",
        "username": "_007"
      }
    }
  ],
  "totalComment": 1,
  "title": "This case will self-destruct in 5 seconds",
  "tags": [
    "phishing",
    "social engineering"
  ],
  "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.",
  "closed_at": null,
  "closed_by": null,
  "created_at": "2020-04-02T15:25:19.088Z",
  "created_by": {
    "email": "ahunley@imf.usa.gov",
    "full_name": "Alan Hunley",
    "username": "ahunley"
  },
  "external_service": null,
  "owner": "securitySolution",
  "status": "open",
  "updated_at": "2020-04-02T15:34:01.118Z",
  "updated_by": {
    "email": "jbond@hms.gov.uk",
    "full_name": "James Bond",
    "username": "_007"
  }
}