Get case settings

Base URL
https://{kibana_url}
  • GET /api/cases/configure
Auth

Get setting details such as the closure type, custom fields, templates, and the default connector for cases. You must have read privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where the cases were created.

Query parameters

owner union oneOf

A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.

Values: cases observability securitySolution

Responses

Indicates a successful call.

application/json
<array> object[]
closure_type enum

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

Values: close-by-pushing close-by-user
connector object
fields object nullable

The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

id string

The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

name string

The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

type enum

The type of connector.

Values: .cases-webhook .jira .none .resilient .servicenow .servicenow-sir .swimlane
created_at string · format: date-time
created_by object
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
customFields object[]

Custom fields configuration details.

defaultValue boolean | string

A default value for the custom field. If the type is text, the default value must be a string. If the type is toggle, the default value must be boolean.

key string · min length: 1 · max length: 36

A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.

label string · min length: 1 · max length: 50

The custom field label that is displayed in the case.

type enum

The type of the custom field.

Values: text toggle
required boolean

Indicates whether the field is required. If false, the custom field can be set to null or omitted when a case is created or updated.

error string nullable
id string
mappings object[]
action_type string
source string
target string
observableTypes object[]

Custom observable type configuration details.

key string

The observable type key.

label string

The observable type label.

owner enum

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
templates object[]
caseFields object
assignees object[] · max items: 10 nullable

An array containing users that are assigned to the case.

uid string required

A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.

category string · max length: 50

A word or phrase that categorizes the case.

connector object
fields object nullable

The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

id string

The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

name string

The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

type enum

The type of connector.

Values: .cases-webhook .jira .none .resilient .servicenow .servicenow-sir .swimlane
customFields object[]

Custom field values in the template.

key string

The unique key for the custom field.

type enum

The type of the custom field.

Values: text toggle
value boolean | string

The default value for the custom field when a case uses the template. If the type is text, the default value must be a string. If the type is toggle, the default value must be boolean.

description string · max length: 30000

The description for the case.

settings object

An object that contains the case settings.

extractObservables boolean

When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.

syncAlerts boolean required

Turns alert syncing on or off.

severity enum

The severity of the case.

Values: critical high low medium
tags string[] · max items: 200

The words and phrases that help categorize cases. It can be an empty array.

title string · max length: 160

A title for the case.

description string

A description for the template.

key string

A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.

name string

The name of the template.

tags string[] · max items: 200

The words and phrases that help categorize templates. It can be an empty array.

updated_at string · format: date-time nullable
updated_by object nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
version string

Authorization information is missing or invalid.

application/json
error string
message string
statusCode integer
Base URL
https://{kibana_url}