The SIEM app is now a part of the Elastic Security solution. Click here to view SIEM documentation for previous releases.
« Add comment Update comment »
Elastic Docs ›Elastic Security Solution [7.9] ›Elastic Security APIs ›Cases API

Update case

edit

Update case

edit

Updates existing cases.

Request URL

edit

PATCH <kibana host>:<port>/api/cases

Request body

edit

A JSON array containing one or more case objects with updated field values:

Name Type Description Required

cases

cases[]

Array containing one or more case objects.

Yes

cases schema

edit
Name Type Description Required

id

String

The ID of the case being updated.

Yes

title

String

The updated case title.

No

connector_id

String

ID of the connector used for pushing case updates to external systems (returned when calling Find connectors).

No

description

String

The updated case description.

No

status

String

The updated case status, which can be:

  • open
  • closed

No

tags

String[]

The updated case tags.

No

version

String

The current case version (returned when calling Get case or Find cases).

Yes

Example request

edit

Updates the description, tags, and connector of case ID a18b38a0-71b0-11ea-a0b2-c51ea50a58e2:

PATCH api/cases
{
  "cases": [
    {
      "connector_id": "5b347c7b-6925-4452-a4dd-215550294ba2",
      "id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2",
      "description": "James Bond clicked on a highly suspicious email
      banner advertising cheap holidays for underpaid civil servants.
      Operation bubblegum is active. Repeat - operation bubblegum is
      now active!",
      "tags": [
        "phishing",
        "social engineering",
        "bubblegum"
      ],
      "version": "WzIzLDFd"
    }
  ]
}

Response code

edit
200
Indicates a successful call.

Response payload

edit

The updated case with a new version value.

Example response

edit
[
  {
    "id": "66b9aa00-94fa-11ea-9f74-e7e108796192",
    "version": "WzU0OCwxXQ==",
    "comments": [],
    "totalComment": 0,
    "connector_id": "5b347c7b-6925-4452-a4dd-215550294ba2",
    "title": "This case will self-destruct in 5 seconds",
    "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
    "tags": [
      "phishing",
      "social engineering",
      "bubblegum"
    ],
    "closed_at": null,
    "closed_by": null,
    "created_at": "2020-05-13T09:16:17.416Z",
    "created_by": {
      "email": "ahunley@imf.usa.gov",
      "full_name": "Alan Hunley",
      "username": "ahunley"
    },
    "external_service": {
      "external_title": "IS-4",
      "pushed_by": {
        "full_name": "Classified",
        "email": "classified@hms.oo.gov.uk",
        "username": "M"
      },
      "external_url": "https://hms.atlassian.net/browse/IS-4",
      "pushed_at": "2020-05-13T09:20:40.672Z",
      "connector_id": "05da469f-1fde-4058-99a3-91e4807e2de8",
      "external_id": "10003",
      "connector_name": "Jira"
    },
    "status": "open",
    "updated_at": "2020-05-13T09:48:33.043Z",
    "updated_by": {
      "email": "classified@hms.oo.gov.uk",
      "full_name": "Classified",
      "username": "M"
    }
  }
]
« Add comment Update comment »