Update cases
- Base URL
-
https://{kibana_url}
- PATCH /api/cases
- PATCH /s/{space_id}/api/cases
Refer to Spaces for more information.
You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you're updating.
Request body
-
casesobject · min items: 1 · max items: 100required -
An array containing one or more case objects.
-
closeReasononeOf -
The close reason to sync to attached alerts when closing the case. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user.
-
Values:
false_positiveduplicatetrue_positivebenign_positiveautomated_closureother -
customFieldsobject · min items: 0 · max items: 10deprecated -
Custom field values for a case. Omitted optional fields default to null. Deprecated: use
extended_fieldsinstead. -
keystringrequired -
The unique identifier for the custom field. The key value must exist in the case configuration settings.
-
typerequired -
The custom field type. It must match the type specified in the case configuration settings.
-
Values:
texttoggle -
valuestring | booleanrequired nullable -
The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is
undefined. The value returned in the API and user interface in this case isnull. -
extended_fieldsmap string to string · max properties: 500 -
Case field values keyed by storage key (for example,
priority_as_keyword). Keys are validated against the fields exposed by the case's active template and global field library. On update, provided keys are merged into the stored map; unlisted keys are left untouched. Template-linked fields require thexpack.cases.templates.enabledsetting (enabled by default); global fields are always available. Use the get case fields API to discover valid keys. -
<string>string · max length: 30000 -
settingsobject -
An object that contains the case settings.
-
extractObservablesboolean -
When true, observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments. When omitted on create, the space configuration default is used. Falls back to the owner's default when no space configuration exists:
truefor Security,falsefor Stack and Observability. Precedence: explicit value > template setting > space config > owner default. For owners that do not support observable extraction (currently Observability), an omitted value resolves tofalseregardless of the space configuration. -
The words and phrases that help categorize cases. It can be an empty array.
-
templateobjectnullable -
The case template to apply, clear, or leave unchanged. Requires the
xpack.cases.templates.enabledsetting. Omit to keep the current template; set tonullto clear it; set to{ id, version }to switch. Switching is an explicit versioned action: bothidandversionare required. Ifextended_fieldsis also provided in the same request, those values are validated against the new template's fields. Use the get case fields API to see what fields the new template exposes.