Create connectoredit
Creates a connector, which can then be used to open and update cases in external systems.
The Kibana Console supports only Elasticsearch APIs. You cannot interact with the Kibana APIs with the Console and must use curl
or another HTTP tool instead. For more information, refer to Console.
Request URLedit
POST <kibana host>:<port>/api/actions/action
Request bodyedit
A JSON object with these fields:
Name | Type | Description | Required |
---|---|---|---|
|
String |
Must be one of these:
|
Yes |
|
Object containing the action’s configuration. |
Yes |
|
|
Object |
Object containing the third-party account information used to create and update incidents. For ServiceNow connectors:
For Jira connectors:
For IBM Resilient connectors:
|
Yes |
|
String |
The connector’s name. |
Yes |
Name | Type | Description | Required |
---|---|---|---|
|
String |
URL of the third-party instance. |
Yes |
|
String |
Jira project key. |
For Jira connectors, yes. For other connectors, no. |
|
String |
IBM Resilient organization ID. |
For IBM Resilient connectors, yes. For other connectors, no. |
Example requestsedit
Creates a ServiceNow connector:
POST api/actions/action { "actionTypeId": ".servicenow", "config": { "apiUrl": "https://dev87359.service-now.com", }, "secrets": { "username": "admin", "password": "securePassword123!" }, "name": "ServiceNow" }
Creates a Jira connector:
POST api/actions/action { "actionTypeId": ".jira", "config": { "apiUrl": "https://hms.atlassian.net", "projectKey": "HMS" }, "secrets": { "email": "admin@hms.gov.co.uk", "apiToken": "my-api-token" }, "name": "Jira" }
Creates an IBM Resilient connector:
POST api/actions/action { "actionTypeId": ".resilient", "config": { "apiUrl": "https://ibm-resilient.siem.estc.dev", "orgId": "201" }, "secrets": { "apiKeyId": "2ad2bbd3-7cd2-3096-9619-de13c5ab70ca", "apiKeySecret": "Hzol67ZoeATAR-8pQxSp3q_NPTDtWU6_QNBoCSCA-ic" }, "name": "IBM" }
Response codeedit
-
200
- Indicates a successful call.
Response payloadedit
A JSON object with a connector id
that is required to push cases to ServiceNow.
Example responseedit
ServiceNow connector:
{ "id": "f07a60c7-a340-4cb1-93b8-1f5e35dc56b1", "actionTypeId": ".servicenow", "name": "SN API 2", "config": { "apiUrl": "https://dev185413.service-now.com", }, "isPreconfigured": false }