/kibana-cases | Type: Application | PCID required: Yes
Tools
kibana_cases_add_case_comment_default_space
Add a case comment or alert Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
body | object | Yes | — | The add comment to case API request body varies depending on whether you are adding an alert or a comment. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
},
"body": {
"description": "The add comment to case API request body varies depending on whether you are adding an alert or a comment."
}
},
"required": [
"PCID",
"kbn-xsrf",
"caseId",
"body"
]
}
kibana_cases_add_case_file_default_space
Attach a file to a case Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
file | string | Yes | — | The file being attached to the case. |
filename | string | No | — | The desired name of the file being attached to the case, it can be different than the name of the file in the filesystem. This should not include the file extension. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
},
"file": {
"type": "string",
"description": "The file being attached to the case."
},
"filename": {
"type": "string",
"description": "The desired name of the file being attached to the case, it can be different than the name of the file in the filesystem. **This should not include the file extension.**"
}
},
"required": [
"PCID",
"kbn-xsrf",
"caseId",
"file"
]
}
kibana_cases_create_case_default_space
Create a case Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
assignees | object[] | No | — | An array containing users that are assigned to the case. |
category | string | No | — | A word or phrase that categorizes the case. |
connector | object | Yes | — | The connector value |
customFields | object[] | No | — | Custom field values for a case. Any optional custom fields that are not specified in the request are set to null. |
description | string | Yes | — | The description for the case. |
owner | string | Yes | — | The application that owns the cases: Stack Management, Observability, or Elastic Security. |
settings | object | Yes | — | An object that contains the case settings. |
severity | string | No | — | The severity of the case. |
tags | string[] | Yes | — | The words and phrases that help categorize cases. It can be an empty array. |
title | string | Yes | — | A title for the case. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"assignees": {
"type": "array",
"items": {
"type": "object",
"properties": {
"uid": {
"type": "string",
"description": "A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API."
}
},
"required": [
"uid"
]
},
"description": "An array containing users that are assigned to the case."
},
"category": {
"type": "string",
"description": "A word or phrase that categorizes the case."
},
"connector": {
"description": "The connector value"
},
"customFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The unique identifier for the custom field. The key value must exist in the case configuration settings."
},
"type": {
"type": "string",
"enum": [
"text",
"toggle"
],
"description": "The custom field type. It must match the type specified in the case configuration settings."
},
"value": {
"description": "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`."
}
},
"required": [
"key",
"type",
"value"
]
},
"description": "Custom field values for a case. Any optional custom fields that are not specified in the request are set to null."
},
"description": {
"type": "string",
"description": "The description for the case."
},
"owner": {
"type": "string",
"description": "The application that owns the cases: Stack Management, Observability, or Elastic Security.",
"enum": [
"cases",
"observability",
"securitySolution"
]
},
"settings": {
"type": "object",
"description": "An object that contains the case settings.",
"properties": {
"extractObservables": {
"type": "boolean",
"description": "When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted."
},
"syncAlerts": {
"type": "boolean",
"description": "Turns alert syncing on or off."
}
},
"required": [
"syncAlerts"
]
},
"severity": {
"type": "string",
"description": "The severity of the case.",
"enum": [
"critical",
"high",
"low",
"medium"
]
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The words and phrases that help categorize cases. It can be an empty array."
},
"title": {
"type": "string",
"description": "A title for the case."
}
},
"required": [
"PCID",
"kbn-xsrf",
"connector",
"description",
"owner",
"settings",
"tags",
"title"
]
}
kibana_cases_delete_case_comment_default_space
Delete a case comment or alert Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
commentId | string | Yes | — | The identifier for the comment. To retrieve comment IDs, use the get case or search cases (_find) APIs. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
},
"commentId": {
"type": "string",
"description": "The identifier for the comment. To retrieve comment IDs, use the get case or search cases (`_find`) APIs."
}
},
"required": [
"PCID",
"kbn-xsrf",
"caseId",
"commentId"
]
}
kibana_cases_delete_case_comments_default_space
Delete all case comments and alerts Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
}
},
"required": [
"PCID",
"kbn-xsrf",
"caseId"
]
}
kibana_cases_delete_case_default_space
Delete cases Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
ids | string[] | Yes | — | The cases that you want to removed. To get the case identifiers, use the search cases (_find) API. In the Dev Console, you can specify the array of cases in the following format: ids=["e58e77e3-ef8e-4251-926f-efb115f3c4ec"]. In curl, all non-ASCII characters must be URL encoded. For example: ids=%5B%22e58e77e3-ef8e-4251-926f-efb115f3c4ec%22%5D |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "The cases that you want to removed. To get the case identifiers, use the search cases (`_find`) API. In the Dev Console, you can specify the array of cases in the following format: `ids=[\"e58e77e3-ef8e-4251-926f-efb115f3c4ec\"]`. In `curl`, all non-ASCII characters must be URL encoded. For example: `ids=%5B%22e58e77e3-ef8e-4251-926f-efb115f3c4ec%22%5D`"
}
},
"required": [
"PCID",
"kbn-xsrf",
"ids"
]
}
kibana_cases_find_case_activity_default_space
Find case activity Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
page | integer | No | — | The page number to return. |
perPage | integer | No | — | The number of items to return. Limited to 100 items. |
sortOrder | string | No | — | Determines the sort order. |
types | string[] | No | — | Determines the types of user actions to return. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
},
"page": {
"type": "integer",
"description": "The page number to return."
},
"perPage": {
"type": "integer",
"description": "The number of items to return. Limited to 100 items."
},
"sortOrder": {
"type": "string",
"description": "Determines the sort order.",
"enum": [
"asc",
"desc"
]
},
"types": {
"type": "array",
"items": {
"type": "string",
"enum": [
"action",
"alert",
"assignees",
"attachment",
"comment",
"connector",
"create_case",
"description",
"pushed",
"settings",
"severity",
"status",
"tags",
"title",
"user"
]
},
"description": "Determines the types of user actions to return."
}
},
"required": [
"PCID",
"caseId"
]
}
kibana_cases_find_case_comments_default_space
Find case comments Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
page | integer | No | — | The page number to return. |
perPage | integer | No | — | The number of items to return. Limited to 100 items. |
sortOrder | string | No | — | Determines the sort order. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
},
"page": {
"type": "integer",
"description": "The page number to return."
},
"perPage": {
"type": "integer",
"description": "The number of items to return. Limited to 100 items."
},
"sortOrder": {
"type": "string",
"description": "Determines the sort order.",
"enum": [
"asc",
"desc"
]
}
},
"required": [
"PCID",
"caseId"
]
}
kibana_cases_find_case_connectors_default_space
Get case connectorsShow inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
}
},
"required": [
"PCID"
]
}
kibana_cases_find_cases_default_space
Search cases Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
assignees | string[] | No | — | Filters the returned cases by assignees. Valid values are none or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API. |
category | string[] | No | — | Filters the returned cases by category. |
defaultSearchOperator | string | No | — | he default operator to use for the simple_query_string. |
from | string | No | — | Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression. |
owner | string[] | No | — | A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. |
page | integer | No | — | The page number to return. |
perPage | integer | No | — | The number of items to return. Limited to 100 items. |
reporters | string[] | No | — | Filters the returned cases by the user name of the reporter. |
search | string | No | — | An Elasticsearch simple_query_string query that filters the objects in the response. |
searchFields | string[] | No | — | The fields to perform the simple_query_string parsed query against. |
severity | string | No | — | The severity of the case. |
sortField | string | No | — | Determines which field is used to sort the results. |
sortOrder | string | No | — | Determines the sort order. |
status | string | No | — | Filters the returned cases by state. |
tags | string[] | No | — | Filters the returned cases by tags. |
to | string | No | — | Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"assignees": {
"type": "array",
"items": {
"type": "string"
},
"description": "Filters the returned cases by assignees. Valid values are `none` or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API."
},
"category": {
"type": "array",
"items": {
"type": "string"
},
"description": "Filters the returned cases by category."
},
"defaultSearchOperator": {
"type": "string",
"description": "he default operator to use for the simple_query_string."
},
"from": {
"type": "string",
"description": "Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression."
},
"owner": {
"type": "array",
"items": {
"type": "string",
"enum": [
"cases",
"observability",
"securitySolution"
]
},
"description": "A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read."
},
"page": {
"type": "integer",
"description": "The page number to return."
},
"perPage": {
"type": "integer",
"description": "The number of items to return. Limited to 100 items."
},
"reporters": {
"type": "array",
"items": {
"type": "string"
},
"description": "Filters the returned cases by the user name of the reporter."
},
"search": {
"type": "string",
"description": "An Elasticsearch simple_query_string query that filters the objects in the response."
},
"searchFields": {
"type": "array",
"items": {
"type": "string",
"enum": [
"description",
"title"
]
},
"description": "The fields to perform the simple_query_string parsed query against."
},
"severity": {
"type": "string",
"description": "The severity of the case.",
"enum": [
"critical",
"high",
"low",
"medium"
]
},
"sortField": {
"type": "string",
"description": "Determines which field is used to sort the results.",
"enum": [
"createdAt",
"updatedAt",
"closedAt",
"title",
"category",
"status",
"severity"
]
},
"sortOrder": {
"type": "string",
"description": "Determines the sort order.",
"enum": [
"asc",
"desc"
]
},
"status": {
"type": "string",
"description": "Filters the returned cases by state.",
"enum": [
"closed",
"in-progress",
"open"
]
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "Filters the returned cases by tags."
},
"to": {
"type": "string",
"description": "Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression."
}
},
"required": [
"PCID"
]
}
kibana_cases_get_by_alert_default_space
Get cases for an alert Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
alertId | string | Yes | — | An identifier for the alert. |
owner | string[] | No | — | A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"alertId": {
"type": "string",
"description": "An identifier for the alert."
},
"owner": {
"type": "array",
"items": {
"type": "string",
"enum": [
"cases",
"observability",
"securitySolution"
]
},
"description": "A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read."
}
},
"required": [
"PCID",
"alertId"
]
}
kibana_cases_get_case_alerts_default_space
Get all alerts for a case Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
}
},
"required": [
"PCID",
"caseId"
]
}
kibana_cases_get_case_comment_default_space
Get a case comment or alert Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
commentId | string | Yes | — | The identifier for the comment. To retrieve comment IDs, use the get case or search cases (_find) APIs. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
},
"commentId": {
"type": "string",
"description": "The identifier for the comment. To retrieve comment IDs, use the get case or search cases (`_find`) APIs."
}
},
"required": [
"PCID",
"caseId",
"commentId"
]
}
kibana_cases_get_case_configuration_default_space
Get case settings Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
owner | string[] | No | — | A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"owner": {
"type": "array",
"items": {
"type": "string",
"enum": [
"cases",
"observability",
"securitySolution"
]
},
"description": "A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read."
}
},
"required": [
"PCID"
]
}
kibana_cases_get_case_default_space
Get case information Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
}
},
"required": [
"PCID",
"caseId"
]
}
kibana_cases_get_case_reporters_default_space
Get case creators Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
owner | string[] | No | — | A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"owner": {
"type": "array",
"items": {
"type": "string",
"enum": [
"cases",
"observability",
"securitySolution"
]
},
"description": "A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read."
}
},
"required": [
"PCID"
]
}
kibana_cases_get_case_tags_default_space
Get case tags Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
owner | string[] | No | — | A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"owner": {
"type": "array",
"items": {
"type": "string",
"enum": [
"cases",
"observability",
"securitySolution"
]
},
"description": "A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read."
}
},
"required": [
"PCID"
]
}
kibana_cases_push_case_default_space
Push a case to an external service Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
connectorId | string | Yes | — | An identifier for the connector. To retrieve connector IDs, use the find connectors API. |
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
body | object | No | — | Request body |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
},
"connectorId": {
"type": "string",
"description": "An identifier for the connector. To retrieve connector IDs, use the find connectors API."
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"body": {
"type": "object",
"description": "Request body"
}
},
"required": [
"PCID",
"caseId",
"connectorId",
"kbn-xsrf"
]
}
kibana_cases_set_case_configuration_default_space
Add case settings Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
closure_type | string | Yes | — | Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user). |
connector | object | Yes | — | An object that contains the connector configuration. |
customFields | object[] | No | — | Custom fields case configuration. |
owner | string | Yes | — | The application that owns the cases: Stack Management, Observability, or Elastic Security. |
templates | object[] | No | — | The templates value |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"closure_type": {
"type": "string",
"description": "Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).",
"enum": [
"close-by-pushing",
"close-by-user"
]
},
"connector": {
"type": "object",
"description": "An object that contains the connector configuration.",
"properties": {
"fields": {
"type": "object",
"description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`."
},
"id": {
"type": "string",
"description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API."
},
"name": {
"type": "string",
"description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API."
},
"type": {
"type": "string",
"description": "The type of connector.",
"enum": [
".cases-webhook",
".jira",
".none",
".resilient",
".servicenow",
".servicenow-sir",
".swimlane"
]
}
},
"required": [
"fields",
"id",
"name",
"type"
]
},
"customFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"defaultValue": {
"description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean."
},
"key": {
"type": "string",
"description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field."
},
"label": {
"type": "string",
"description": "The custom field label that is displayed in the case."
},
"type": {
"type": "string",
"enum": [
"text",
"toggle"
],
"description": "The type of the custom field."
},
"required": {
"type": "boolean",
"description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated."
}
},
"required": [
"key",
"label",
"required",
"type"
]
},
"description": "Custom fields case configuration."
},
"owner": {
"type": "string",
"description": "The application that owns the cases: Stack Management, Observability, or Elastic Security.",
"enum": [
"cases",
"observability",
"securitySolution"
]
},
"templates": {
"type": "array",
"items": {
"type": "object",
"properties": {
"caseFields": {
"type": "object",
"description": "Case Fields"
},
"description": {
"type": "string",
"description": "A description for the template."
},
"key": {
"type": "string",
"description": "A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template."
},
"name": {
"type": "string",
"description": "The name of the template."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The words and phrases that help categorize templates. It can be an empty array."
}
}
},
"description": "The templates value"
}
},
"required": [
"PCID",
"kbn-xsrf",
"closure_type",
"connector",
"owner"
]
}
kibana_cases_update_case_comment_default_space
Update a case comment or alert Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
caseId | string | Yes | — | The identifier for the case. To retrieve case IDs, use the search cases (_find) API. All non-ASCII characters must be URL encoded. |
body | object | Yes | — | The update case comment API request body varies depending on whether you are updating an alert or a comment. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"caseId": {
"type": "string",
"description": "The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded."
},
"body": {
"description": "The update case comment API request body varies depending on whether you are updating an alert or a comment."
}
},
"required": [
"PCID",
"kbn-xsrf",
"caseId",
"body"
]
}
kibana_cases_update_case_configuration_default_space
Update case settings Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
configurationId | string | Yes | — | An identifier for the configuration. |
closure_type | string | No | — | Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user). |
connector | object | No | — | An object that contains the connector configuration. |
customFields | object[] | No | — | Custom fields case configuration. |
templates | object[] | No | — | The templates value |
version | string | Yes | — | The version of the connector. To retrieve the version value, use the get configuration API. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"configurationId": {
"type": "string",
"description": "An identifier for the configuration."
},
"closure_type": {
"type": "string",
"description": "Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).",
"enum": [
"close-by-pushing",
"close-by-user"
]
},
"connector": {
"type": "object",
"description": "An object that contains the connector configuration.",
"properties": {
"fields": {
"type": "object",
"description": "The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`."
},
"id": {
"type": "string",
"description": "The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API."
},
"name": {
"type": "string",
"description": "The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API."
},
"type": {
"type": "string",
"description": "The type of connector.",
"enum": [
".cases-webhook",
".jira",
".none",
".resilient",
".servicenow",
".servicenow-sir",
".swimlane"
]
}
},
"required": [
"fields",
"id",
"name",
"type"
]
},
"customFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"defaultValue": {
"description": "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean."
},
"key": {
"type": "string",
"description": "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field."
},
"label": {
"type": "string",
"description": "The custom field label that is displayed in the case."
},
"type": {
"type": "string",
"enum": [
"text",
"toggle"
],
"description": "The type of the custom field."
},
"required": {
"type": "boolean",
"description": "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated."
}
},
"required": [
"key",
"label",
"required",
"type"
]
},
"description": "Custom fields case configuration."
},
"templates": {
"type": "array",
"items": {
"type": "object",
"properties": {
"caseFields": {
"type": "object",
"description": "Case Fields"
},
"description": {
"type": "string",
"description": "A description for the template."
},
"key": {
"type": "string",
"description": "A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template."
},
"name": {
"type": "string",
"description": "The name of the template."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The words and phrases that help categorize templates. It can be an empty array."
}
}
},
"description": "The templates value"
},
"version": {
"type": "string",
"description": "The version of the connector. To retrieve the version value, use the get configuration API."
}
},
"required": [
"PCID",
"kbn-xsrf",
"configurationId",
"version"
]
}
kibana_cases_update_case_default_space
Update cases Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
kbn-xsrf | string | Yes | — | Cross-site request forgery protection |
cases | object[] | Yes | — | An array containing one or more case objects. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"kbn-xsrf": {
"type": "string",
"description": "Cross-site request forgery protection"
},
"cases": {
"type": "array",
"items": {
"type": "object",
"properties": {
"assignees": {
"type": "array",
"items": {
"type": "object",
"properties": {
"uid": {
"type": "string",
"description": "A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API."
}
}
},
"description": "An array containing users that are assigned to the case."
},
"category": {
"type": "string",
"description": "A word or phrase that categorizes the case."
},
"closeReason": {
"description": "The close reason to sync to attached alerts when closing the case. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user."
},
"connector": {
"description": "The connector value"
},
"customFields": {
"type": "array",
"items": {
"type": "object",
"properties": {
"key": {
"type": "string",
"description": "The unique identifier for the custom field. The key value must exist in the case configuration settings. "
},
"type": {
"type": "string",
"description": "The custom field type. It must match the type specified in the case configuration settings. "
},
"value": {
"description": "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`. "
}
}
},
"description": "Custom field values for a case. Any optional custom fields that are not specified in the request are set to null."
},
"description": {
"type": "string",
"description": "The description for the case."
},
"id": {
"type": "string",
"description": "The identifier for the case."
},
"settings": {
"type": "object",
"description": "An object that contains the case settings."
},
"severity": {
"type": "string",
"enum": [
"critical",
"high",
"low",
"medium"
],
"description": "The severity of the case."
},
"status": {
"type": "string",
"enum": [
"closed",
"in-progress",
"open"
],
"description": "The status of the case."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "The words and phrases that help categorize cases. It can be an empty array."
},
"title": {
"type": "string",
"description": "A title for the case."
},
"version": {
"type": "string",
"description": "The current version of the case. To determine this value, use the get case or search cases (`_find`) APIs."
}
},
"required": [
"id",
"version"
]
},
"description": "An array containing one or more case objects."
}
},
"required": [
"PCID",
"kbn-xsrf",
"cases"
]
}