Update case settings

Base URL
https://{kibana_url}
Auth

Updates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where the case was created.

Path parameters

configurationId string required

An identifier for the configuration.

Example: 3297a0f0-b5ec-11ec-b141-0fdb20a7f9a9

Header parameters

kbn-xsrf string required

Cross-site request forgery protection

Request body

closure_type enum

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

Values: close-by-pushing close-by-user
connector object

An object that contains the connector configuration.

fields object required nullable

The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

id string required

The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

name string required

The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

type enum required

The type of connector.

Values: .cases-webhook .jira .none .resilient .servicenow .servicenow-sir .swimlane
customFields object[]

Custom fields case configuration.

defaultValue boolean | string

A default value for the custom field. If the type is text, the default value must be a string. If the type is toggle, the default value must be boolean.

key string · min length: 1 · max length: 36 required

A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.

label string · min length: 1 · max length: 50 required

The custom field label that is displayed in the case.

type enum required

The type of the custom field.

Values: text toggle
required boolean required

Indicates whether the field is required. If false, the custom field can be set to null or omitted when a case is created or updated.

templates object[]
caseFields object
assignees object[] · max items: 10 nullable

An array containing users that are assigned to the case.

uid string required

A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.

category string · max length: 50

A word or phrase that categorizes the case.

connector object
fields object nullable

The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

id string

The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

name string

The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

type enum

The type of connector.

Values: .cases-webhook .jira .none .resilient .servicenow .servicenow-sir .swimlane
customFields object[]

Custom field values in the template.

key string

The unique key for the custom field.

type enum

The type of the custom field.

Values: text toggle
value boolean | string

The default value for the custom field when a case uses the template. If the type is text, the default value must be a string. If the type is toggle, the default value must be boolean.

description string · max length: 30000

The description for the case.

settings object

An object that contains the case settings.

extractObservables boolean

When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.

syncAlerts boolean required

Turns alert syncing on or off.

severity enum

The severity of the case.

Values: critical high low medium
tags string[] · max items: 200

The words and phrases that help categorize cases. It can be an empty array.

title string · max length: 160

A title for the case.

description string

A description for the template.

key string

A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.

name string

The name of the template.

tags string[] · max items: 200

The words and phrases that help categorize templates. It can be an empty array.

version string required

The version of the connector. To retrieve the version value, use the get configuration API.

Responses

Indicates a successful call.

application/json
closure_type enum

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

Values: close-by-pushing close-by-user
connector object
fields object nullable

The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

id string

The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

name string

The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

type enum

The type of connector.

Values: .cases-webhook .jira .none .resilient .servicenow .servicenow-sir .swimlane
created_at string · format: date-time
created_by object
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
customFields object[]

Custom fields configuration details.

defaultValue boolean | string

A default value for the custom field. If the type is text, the default value must be a string. If the type is toggle, the default value must be boolean.

key string · min length: 1 · max length: 36

A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.

label string · min length: 1 · max length: 50

The custom field label that is displayed in the case.

type enum

The type of the custom field.

Values: text toggle
required boolean

Indicates whether the field is required. If false, the custom field can be set to null or omitted when a case is created or updated.

error string nullable
id string
mappings object[]
action_type string
source string
target string
observableTypes object[]

Custom observable type configuration details.

key string

The observable type key.

label string

The observable type label.

owner enum

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
templates object[]
Same fields as templates
updated_at string · format: date-time nullable
updated_by object nullable
email string required nullable
full_name string required nullable
profile_uid string
username string required nullable
version string

Authorization information is missing or invalid.

application/json
error string
message string
statusCode integer
Base URL
https://{kibana_url}