Add case settings

Base URL: https://{kibana_url}

POST /api/cases/configure
POST /s/{space_id}/api/cases/configure

Refer to Spaces for more information.

Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where you are creating cases.

closure_type enum required: Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).; Values: close-by-pushing close-by-user
connector object required: An object that contains the connector configuration.
customFields object[] · min items: 0 · max items: 10 deprecated: Custom fields case configuration. Deprecated. Use the field library (/api/cases/field_definitions) to manage field definitions and extended_fields on case create/update to set field values.
extractObservables boolean: Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events. When omitted, defaults to the owner's default: true for Security, false for Stack and Observability. For owners that do not support observable extraction (currently Observability), setting this to true has no effect on case creation; new cases for those owners always use false.
owner enum required: The application that owns the cases: Stack Management, Observability, or Elastic Security.; Values: cases observability securitySolution
templates object[] deprecated: Configuration-embedded templates. Deprecated: use the templates API (GET /api/cases/templates) and case extended_fields instead.
workflowTags string[] · max items: 100: Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Responses

Indicates a successful call.

application/json

closure_type enum: Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).; Values: close-by-pushing close-by-user
connector object
created_at string · format: date-time
created_by object
customFields object[] deprecated: Custom fields configuration details. Deprecated. Use the field library (/api/cases/field_definitions) to manage field definitions and extended_fields on case create/update to set field values.
error string nullable
extractObservables boolean: Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.
id string
mappings object[]
observableTypes object[]: Custom observable type configuration details.
owner enum: The application that owns the cases: Stack Management, Observability, or Elastic Security.; Values: cases observability securitySolution
templates object[] deprecated: Configuration-embedded templates. Deprecated: use the templates API (GET /api/cases/templates) and case extended_fields instead.; Same fields as templates
updated_at string · format: date-time nullable
updated_by object nullable
version string
workflowTags string[] · max items: 100: Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Authorization information is missing or invalid.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/cases/configure
{
  "closure_type": "close-by-user",
  "connector": {
    "fields": "null",
    "id": "5e656730-e1ca-11ec-be9b-9b1838238ee6",
    "name": "my-jira-connector",
    "type": ".jira"
  },
  "customFields": [
    {
      "defaultValue": "My custom field default value.",
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "label": "my-text-field",
      "type": "text",
      "required": false
    }
  ],
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
          }
        ],
        "category": "Default-category",
        "customFields": [
          {
            "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
            "type": "text",
            "value": "A text field value for the template."
          }
        ],
        "description": "A default description for cases.",
        "tags": [
          "Default case tag"
        ],
        "title": "Default case title"
      },
      "description": "A description of the template.",
      "key": "505932fe-ee3a-4960-a661-c781b5acdb05",
      "name": "template-1",
      "tags": [
        "Template tag 1"
      ]
    }
  ],
  "workflowTags": [
    "soc-triage"
  ]
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/cases/configure" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "closure_type": "close-by-user",
    "connector": {
      "fields": "null",
      "id": "5e656730-e1ca-11ec-be9b-9b1838238ee6",
      "name": "my-jira-connector",
      "type": ".jira"
    },
    "customFields": [
      {
        "defaultValue": "My custom field default value.",
        "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
        "label": "my-text-field",
        "type": "text",
        "required": false
      }
    ],
    "owner": "cases",
    "templates": [
      {
        "caseFields": {
          "assignees": [
            {
              "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
            }
          ],
          "category": "Default-category",
          "customFields": [
            {
              "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
              "type": "text",
              "value": "A text field value for the template."
            }
          ],
          "description": "A default description for cases.",
          "tags": [
            "Default case tag"
          ],
          "title": "Default case title"
        },
        "description": "A description of the template.",
        "key": "505932fe-ee3a-4960-a661-c781b5acdb05",
        "name": "template-1",
        "tags": [
          "Template tag 1"
        ]
      }
    ],
    "workflowTags": [
      "soc-triage"
    ]
  }'

Generated from the API spec

Response

{
  "closure_type": "close-by-user",
  "connector": {
    "fields": "null",
    "id": "5e656730-e1ca-11ec-be9b-9b1838238ee6",
    "name": "my-jira-connector",
    "type": ".jira"
  },
  "created_at": "2024-07-01T17:07:17.767Z",
  "created_by": {
    "email": "null,",
    "full_name": "null",
    "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "username": "elastic"
  },
  "customFields": [
    {
      "defaultValue": "My custom field default value.",
      "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
      "label": "my-text-field",
      "type": "text",
      "required": false
    }
  ],
  "error": "null",
  "extractObservables": true,
  "id": "4a97a440-e1cd-11ec-be9b-9b1838238ee6",
  "mappings": [
    {
      "action_type": "overwrite",
      "source": "title",
      "target": "summary"
    },
    {
      "action_type": "overwrite",
      "source": "description",
      "target": "description"
    },
    {
      "action_type": "append",
      "source": "comments",
      "target": "comments"
    },
    {
      "action_type": "overwrite",
      "source": "tags",
      "target": "labels"
    }
  ],
  "owner": "cases",
  "templates": [
    {
      "caseFields": {
        "assignees": [
          {
            "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
          }
        ],
        "category": "Default-category",
        "customFields": [
          {
            "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
            "type": "text",
            "value": "A text field value for the template."
          }
        ],
        "description": "A default description for cases.",
        "tags": [
          "Default case tag"
        ],
        "title": "Default case title"
      },
      "description": "A description of the template.",
      "key": "505932fe-ee3a-4960-a661-c781b5acdb05",
      "name": "template-1",
      "tags": [
        "Template tag 1"
      ]
    }
  ],
  "updated_at": "null",
  "updated_by": "null",
  "version": "WzIwNzMsMV0=",
  "workflowTags": [
    "soc-triage"
  ]
}

{
  "error": "Unauthorized",
  "message": "Unable to authenticate with the provided credentials.",
  "statusCode": 401
}

Add case settings

Authentication

Header parameters

Request body

Responses

Authentication

Header parameters

Request body { }

Responses

Request body