Update case settings
https://{kibana_url}
- PATCH /api/cases/configure/{configurationId}
- PATCH /s/{space_id}/api/cases/configure/{configurationId}
Refer to Spaces for more information.
Updates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where the case was created.
Path Parameters
-
configurationIdstringrequired -
An identifier for the configuration.
Request
-
closure_type -
Indicates whether a case is automatically closed when it is pushed to external systems (
close-by-pushing) or not automatically closed (close-by-user). -
Values:
close-by-pushingclose-by-user -
connectorobject -
An object that contains the connector configuration.
-
fieldsobjectrequired nullable -
The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to
null. -
idstringrequired -
The identifier for the connector. If you do not want a default connector, use
none. To retrieve connector IDs, use the find connectors API. -
namestringrequired -
The name of the connector. If you do not want a default connector, use
none. To retrieve connector names, use the find connectors API. -
type -
The type of connector.
-
Values:
.cases-webhook.jira.none.resilient.servicenow.servicenow-sir.swimlane -
customFieldsobject -
Custom fields case configuration.
-
defaultValueboolean | string -
A default value for the custom field. If the
typeistext, the default value must be a string. If thetypeistoggle, the default value must be boolean. -
keystring · min: 1 · max: 36required -
A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.
-
labelstring · min: 1 · max: 50required -
The custom field label that is displayed in the case.
-
requiredbooleanrequired -
Indicates whether the field is required. If
false, the custom field can be set to null or omitted when a case is created or updated. -
extractObservablesboolean -
Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.
-
templatesobject -
caseFieldsobject -
assigneesnull · max: 10nullable -
An array containing users that are assigned to the case.
-
uidstringrequired -
A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
-
categorystring · max: 50 -
A word or phrase that categorizes the case.
-
connectorobject -
fieldsobjectnullable -
The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to
null. -
idstring -
The identifier for the connector. If you do not want a default connector, use
none. To retrieve connector IDs, use the find connectors API. -
namestring -
The name of the connector. If you do not want a default connector, use
none. To retrieve connector names, use the find connectors API. -
type -
The type of connector.
-
Values:
.cases-webhook.jira.none.resilient.servicenow.servicenow-sir.swimlane -
descriptionstring · max: 30000 -
The description for the case.
-
settings -
An object that contains the case settings.
-
extractObservablesboolean -
When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists:
truefor Security,falsefor Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves tofalseregardless of the space configuration. -
syncAlertsbooleanrequired -
Turns alert syncing on or off.
-
The words and phrases that help categorize cases. It can be an empty array.
-
titlestring · max: 160 -
A title for the case.
-
descriptionstring -
A description for the template.
-
keystring -
A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.
-
namestring -
The name of the template.
-
The words and phrases that help categorize templates. It can be an empty array.
-
versionstringrequired -
The version of the connector. To retrieve the version value, use the get configuration API.
-
workflowTagsstring · max: 100 -
Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.
Responses
Indicates a successful call.
-
closure_type -
Indicates whether a case is automatically closed when it is pushed to external systems (
close-by-pushing) or not automatically closed (close-by-user). -
Values:
close-by-pushingclose-by-user -
connectorobject -
fieldsobjectnullable -
The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to
null. -
idstring -
The identifier for the connector. If you do not want a default connector, use
none. To retrieve connector IDs, use the find connectors API. -
namestring -
The name of the connector. If you do not want a default connector, use
none. To retrieve connector names, use the find connectors API. -
type -
The type of connector.
-
Values:
.cases-webhook.jira.none.resilient.servicenow.servicenow-sir.swimlane -
created_atstring -
created_byobject -
emailstringrequired nullable -
full_namestringrequired nullable -
profile_uidstring -
usernamestringrequired nullable -
customFieldsobject -
Custom fields configuration details.
-
defaultValueboolean | string -
A default value for the custom field. If the
typeistext, the default value must be a string. If thetypeistoggle, the default value must be boolean. -
keystring · min: 1 · max: 36 -
A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.
-
labelstring · min: 1 · max: 50 -
The custom field label that is displayed in the case.
-
requiredboolean -
Indicates whether the field is required. If
false, the custom field can be set to null or omitted when a case is created or updated. -
errorstringnullable -
extractObservablesboolean -
Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.
-
idstring -
mappingsobject -
action_typestring -
sourcestring -
targetstring -
observableTypesobject -
Custom observable type configuration details.
-
owner -
The application that owns the cases: Stack Management, Observability, or Elastic Security.
-
Values:
casesobservabilitysecuritySolution -
templatesobject -
updated_atstringnullable -
updated_byobjectnullable -
emailstringrequired nullable -
full_namestringrequired nullable -
profile_uidstring -
usernamestringrequired nullable -
versionstring -
workflowTagsstring · max: 100 -
Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.
Authorization information is missing or invalid.
-
errorstring -
messagestring -
statusCodeinteger