IMPORTANT: No additional bug fixes or documentation updates will be released for this version.
Add external details to caseedit
Adds the data returned from an external system to the specified case.
After sending a new or updated case to an external system using the Actions API, you must associate the external system’s returned object with the case in the SIEM app.
Request URLedit
POST <kibana host>:<port>/api/cases/<case ID>/_push
URL partsedit
The URL must include the case ID
of the case you are updating. Call
Find cases to retrieve case IDs.
Request bodyedit
A JSON object with the data returned from the external system:
Name | Type | Description | Required |
---|---|---|---|
|
String |
The ID of the connector used to send the case to the external system. |
Yes |
|
String |
The name of the connector used to send the case to the external system.. |
Yes |
|
String |
The |
Yes |
|
String |
The |
Yes |
|
String |
The |
Yes |
Example requestedit
POST api/cases/718265d0-733a-11ea-a0b2-c51ea50a58e2/_push "connector_id": "61787f53-4eee-4741-8df6-8fe84fa616f7", "connector_name": "ServiceNow", "external_id": "74c15d07dbb300106ba884da0b9619a0", "external_title": "INC0010016", "external_url": "https://dev78437.service-now.com/nav_to.do?uri=incident.do?sys_id=74c15d07dbb300106ba884da0b9619a0" }
Response codeedit
-
200
- Indicates a successful call.
Response payloadedit
The updated JSON case object.
Example responseedit
{ "id": "718265d0-733a-11ea-a0b2-c51ea50a58e2", "version": "WzMyNywxXQ==", "comments": [], "totalComment": 0, "closed_at": null, "closed_by": null, "created_at": "2020-03-31T10:29:03.781Z", "created_by": { "email": "ahunley@imf.usa.gov", "full_name": "Alan Hunley", "username": "ahunley" }, "external_service": { "pushed_at": "2020-03-31T10:56:10.959Z", "pushed_by": { "username": "ahunley", "full_name": "Alan Hunley", "email": "ahunley@imf.usa.gov" }, "connector_id": "61787f53-4eee-4741-8df6-8fe84fa616f7", "connector_name": "ServiceNow", "external_id": "74c15d07dbb300106ba884da0b9619a0", "external_title": "INC0010016", "external_url": "https://dev78437.service-now.com/nav_to.do?uri=incident.do?sys_id=74c15d07dbb300106ba884da0b9619a0" }, "updated_at": "2020-03-31T10:56:10.959Z", "updated_by": { "username": "ahunley", "full_name": "Alan Hunley", "email": "ahunley@imf.usa.gov" }, "title": "This case will self-destruct in 5 seconds", "tags": [], "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.", "status": "open" }