Add case settings

Base URL
https://{kibana_url}
  • POST /api/cases/configure
  • POST /s/{space_id}/api/cases/configure
Auth

Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on where you are creating cases.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

Cross-site request forgery protection

Request body

closure_type enum required

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

Values: close-by-pushing close-by-user
connector object required

An object that contains the connector configuration.

fields object required nullable

The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to null.

id string required

The identifier for the connector. If you do not want a default connector, use none. To retrieve connector IDs, use the find connectors API.

name string required

The name of the connector. If you do not want a default connector, use none. To retrieve connector names, use the find connectors API.

type enum required

The type of connector.

Values: .cases-webhook .jira .none .resilient .servicenow .servicenow-sir .swimlane
extractObservables boolean

Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events. When omitted, defaults to the owner's default: true for Security, false for Stack and Observability. Observable extraction is available only for Security cases. For Stack and Observability cases, a value that is not sent resolves to false, and setting it to true returns a 400 error.

owner enum required

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
workflowTags string[] · max items: 100

Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Responses

Indicates a successful call.

application/json
closure_type enum

Indicates whether a case is automatically closed when it is pushed to external systems (close-by-pushing) or not automatically closed (close-by-user).

Values: close-by-pushing close-by-user
created_at string · format: date-time
error string nullable
extractObservables boolean

Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.

id string
owner enum

The application that owns the cases: Stack Management, Observability, or Elastic Security.

Values: cases observability securitySolution
templates object[] deprecated

Configuration-embedded templates. Deprecated: use the templates API (GET /api/cases/templates) and case extended_fields instead.

Same fields as templates
updated_at string · format: date-time nullable
version string
workflowTags string[] · max items: 100

Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.

Base URL
https://{kibana_url}