mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 09:48:58 -04:00
[DOCS] Revise case API examples for consistent tone (#133456)
This commit is contained in:
Lisa Cawley
GitHub
parent
9ca93a552c
commit
05b392a862
17 changed files with 186 additions and 289 deletions
|
|
@ -162,13 +162,9 @@ categorize cases. It can be an empty array.
|
|||
--------------------------------------------------
|
||||
POST api/cases
|
||||
{
|
||||
"description": "James Bond clicked on a highly suspicious email
|
||||
banner advertising cheap holidays for underpaid civil servants.",
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering"
|
||||
],
|
||||
"description": "A case description.",
|
||||
"title": "Case title 1",
|
||||
"tags": [ "tag 1" ],
|
||||
"connector": {
|
||||
"id": "131d4448-abe0-4789-939d-8ef60680b498",
|
||||
"name": "My connector",
|
||||
|
|
@ -182,7 +178,7 @@ POST api/cases
|
|||
"settings": {
|
||||
"syncAlerts": true
|
||||
},
|
||||
"owner": "securitySolution"
|
||||
"owner": "cases"
|
||||
}
|
||||
--------------------------------------------------
|
||||
// KIBANA
|
||||
|
|
@ -198,26 +194,22 @@ the case identifier, version, and creation time. For example:
|
|||
"comments": [],
|
||||
"totalComment": 0,
|
||||
"totalAlerts": 0,
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
],
|
||||
"title": "Case title 1",
|
||||
"tags": [ "tag 1" ],
|
||||
"settings": {
|
||||
"syncAlerts": true
|
||||
},
|
||||
"owner": "securitySolution",
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active",
|
||||
"owner": "cases",
|
||||
"description": "A case description.",
|
||||
"duration": null,
|
||||
"severity": "low",
|
||||
"closed_at": null,
|
||||
"closed_by": null,
|
||||
"created_at": "2022-05-13T09:16:17.416Z",
|
||||
"created_by": {
|
||||
"email": "ahunley@imf.usa.gov",
|
||||
"full_name": "Alan Hunley",
|
||||
"username": "ahunley"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": null,
|
||||
|
|
|
|||
|
|
@ -95,12 +95,12 @@ Defaults to `desc`.
|
|||
|
||||
=== {api-examples-title}
|
||||
|
||||
Retrieve the first five cases with the `phishing` tag, in ascending order by
|
||||
Retrieve the first five cases with the `tag-1` tag, in ascending order by
|
||||
last update time:
|
||||
|
||||
[source,sh]
|
||||
--------------------------------------------------
|
||||
GET api/cases/_find?page=1&perPage=5&sortField=updatedAt&sortOrder=asc&tags=phishing
|
||||
GET api/cases/_find?page=1&perPage=5&sortField=updatedAt&sortOrder=asc&tags=tag-1
|
||||
--------------------------------------------------
|
||||
// KIBANA
|
||||
|
||||
|
|
@ -120,7 +120,7 @@ The API returns a JSON object listing the retrieved cases. For example:
|
|||
"totalComment": 1,
|
||||
"totalAlerts": 0,
|
||||
"title": "Case title",
|
||||
"tags": [ "phishing" ],
|
||||
"tags": [ "tag-1" ],
|
||||
"description": "Case description",
|
||||
"settings": { "syncAlerts": true },
|
||||
"owner": "securitySolution",
|
||||
|
|
|
|||
|
|
@ -159,7 +159,8 @@ and `open`.
|
|||
(Optional, string) A title for the case.
|
||||
|
||||
`version`::
|
||||
(Required, string) The current version of the case. To determine this value, use <<cases-api-get-case>> or <<cases-api-find-cases>>.
|
||||
(Required, string) The current version of the case. To determine this value, use
|
||||
<<cases-api-get-case>> or <<cases-api-find-cases>>.
|
||||
====
|
||||
|
||||
=== {api-response-codes-title}
|
||||
|
|
@ -190,15 +191,8 @@ PATCH api/cases
|
|||
"parent": null
|
||||
}
|
||||
},
|
||||
"description": "James Bond clicked on a highly suspicious email
|
||||
banner advertising cheap holidays for underpaid civil servants.
|
||||
Operation bubblegum is active. Repeat - operation bubblegum is
|
||||
now active!",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
],
|
||||
"description": "A new description.",
|
||||
"tags": [ "tag-1", "tag-2" ],
|
||||
"settings": {
|
||||
"syncAlerts": true
|
||||
}
|
||||
|
|
@ -219,33 +213,29 @@ The API returns the updated case with a new `version` value. For example:
|
|||
"comments": [],
|
||||
"totalComment": 0,
|
||||
"totalAlerts": 0,
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
],
|
||||
"title": "Case title 1",
|
||||
"tags": [ "tag-1", "tag-2" ],
|
||||
"settings": {
|
||||
"syncAlerts": true
|
||||
},
|
||||
"owner": "securitySolution",
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
|
||||
"owner": "cases",
|
||||
"description": "A new description.",
|
||||
"duration": null,
|
||||
"severity": "low",
|
||||
"closed_at": null,
|
||||
"closed_by": null,
|
||||
"created_at": "2022-05-13T09:16:17.416Z",
|
||||
"created_by": {
|
||||
"email": "ahunley@imf.usa.gov",
|
||||
"full_name": "Alan Hunley",
|
||||
"username": "ahunley"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": "2022-05-13T09:48:33.043Z",
|
||||
"updated_by": {
|
||||
"email": "classified@hms.oo.gov.uk",
|
||||
"full_name": "Classified",
|
||||
"username": "M"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"connector": {
|
||||
"id": "131d4448-abe0-4789-939d-8ef60680b498",
|
||||
|
|
@ -260,9 +250,9 @@ The API returns the updated case with a new `version` value. For example:
|
|||
"external_service": {
|
||||
"external_title": "IS-4",
|
||||
"pushed_by": {
|
||||
"full_name": "Classified",
|
||||
"email": "classified@hms.oo.gov.uk",
|
||||
"username": "M"
|
||||
"full_name": null,
|
||||
"email": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"external_url": "https://hms.atlassian.net/browse/IS-4",
|
||||
"pushed_at": "2022-05-13T09:20:40.672Z",
|
||||
|
|
|
|||
|
|
@ -342,7 +342,7 @@
|
|||
},
|
||||
"description": {
|
||||
"type": "string",
|
||||
"example": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active"
|
||||
"example": "A case description."
|
||||
},
|
||||
"duration": {
|
||||
"type": "integer",
|
||||
|
|
@ -417,14 +417,12 @@
|
|||
"type": "string"
|
||||
},
|
||||
"example": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
"tag-1"
|
||||
]
|
||||
},
|
||||
"title": {
|
||||
"type": "string",
|
||||
"example": "This case will self-destruct in 5 seconds"
|
||||
"example": "Case title 1"
|
||||
},
|
||||
"totalAlerts": {
|
||||
"type": "integer",
|
||||
|
|
@ -833,7 +831,7 @@
|
|||
},
|
||||
"description": {
|
||||
"type": "string",
|
||||
"example": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active"
|
||||
"example": "A case description."
|
||||
},
|
||||
"duration": {
|
||||
"type": "integer",
|
||||
|
|
@ -908,14 +906,12 @@
|
|||
"type": "string"
|
||||
},
|
||||
"example": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
"tag-1"
|
||||
]
|
||||
},
|
||||
"title": {
|
||||
"type": "string",
|
||||
"example": "This case will self-destruct in 5 seconds"
|
||||
"example": "Case title 1"
|
||||
},
|
||||
"totalAlerts": {
|
||||
"type": "integer",
|
||||
|
|
@ -1143,7 +1139,7 @@
|
|||
}
|
||||
]
|
||||
},
|
||||
"example": "phishing"
|
||||
"example": "tag-1"
|
||||
},
|
||||
{
|
||||
"name": "to",
|
||||
|
|
@ -1311,7 +1307,7 @@
|
|||
},
|
||||
"description": {
|
||||
"type": "string",
|
||||
"example": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active"
|
||||
"example": "A case description."
|
||||
},
|
||||
"duration": {
|
||||
"type": "integer",
|
||||
|
|
@ -1386,14 +1382,12 @@
|
|||
"type": "string"
|
||||
},
|
||||
"example": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
"tag-1"
|
||||
]
|
||||
},
|
||||
"title": {
|
||||
"type": "string",
|
||||
"example": "This case will self-destruct in 5 seconds"
|
||||
"example": "Case title 1"
|
||||
},
|
||||
"totalAlerts": {
|
||||
"type": "integer",
|
||||
|
|
@ -2736,7 +2730,7 @@
|
|||
},
|
||||
"description": {
|
||||
"type": "string",
|
||||
"example": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active"
|
||||
"example": "A case description."
|
||||
},
|
||||
"duration": {
|
||||
"type": "integer",
|
||||
|
|
@ -2811,14 +2805,12 @@
|
|||
"type": "string"
|
||||
},
|
||||
"example": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
"tag-1"
|
||||
]
|
||||
},
|
||||
"title": {
|
||||
"type": "string",
|
||||
"example": "This case will self-destruct in 5 seconds"
|
||||
"example": "Case title 1"
|
||||
},
|
||||
"totalAlerts": {
|
||||
"type": "integer",
|
||||
|
|
@ -3233,7 +3225,7 @@
|
|||
},
|
||||
"description": {
|
||||
"type": "string",
|
||||
"example": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active"
|
||||
"example": "A case description."
|
||||
},
|
||||
"duration": {
|
||||
"type": "integer",
|
||||
|
|
@ -3308,14 +3300,12 @@
|
|||
"type": "string"
|
||||
},
|
||||
"example": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
"tag-1"
|
||||
]
|
||||
},
|
||||
"title": {
|
||||
"type": "string",
|
||||
"example": "This case will self-destruct in 5 seconds"
|
||||
"example": "Case title 1"
|
||||
},
|
||||
"totalAlerts": {
|
||||
"type": "integer",
|
||||
|
|
@ -3545,7 +3535,7 @@
|
|||
}
|
||||
]
|
||||
},
|
||||
"example": "phishing"
|
||||
"example": "tag-1"
|
||||
},
|
||||
{
|
||||
"name": "to",
|
||||
|
|
@ -3712,7 +3702,7 @@
|
|||
},
|
||||
"description": {
|
||||
"type": "string",
|
||||
"example": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active"
|
||||
"example": "A case description."
|
||||
},
|
||||
"duration": {
|
||||
"type": "integer",
|
||||
|
|
@ -3787,14 +3777,12 @@
|
|||
"type": "string"
|
||||
},
|
||||
"example": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
"tag-1"
|
||||
]
|
||||
},
|
||||
"title": {
|
||||
"type": "string",
|
||||
"example": "This case will self-destruct in 5 seconds"
|
||||
"example": "Case title 1"
|
||||
},
|
||||
"totalAlerts": {
|
||||
"type": "integer",
|
||||
|
|
@ -4977,11 +4965,10 @@
|
|||
"create_case_request": {
|
||||
"summary": "Create a security case that uses a Jira connector.",
|
||||
"value": {
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.",
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"description": "A case description.",
|
||||
"title": "Case title 1",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering"
|
||||
"tag-1"
|
||||
],
|
||||
"connector": {
|
||||
"id": "131d4448-abe0-4789-939d-8ef60680b498",
|
||||
|
|
@ -4996,7 +4983,7 @@
|
|||
"settings": {
|
||||
"syncAlerts": true
|
||||
},
|
||||
"owner": "securitySolution"
|
||||
"owner": "cases"
|
||||
}
|
||||
},
|
||||
"create_case_response": {
|
||||
|
|
@ -5007,26 +4994,24 @@
|
|||
"comments": [],
|
||||
"totalComment": 0,
|
||||
"totalAlerts": 0,
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"title": "Case title 1",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
"tag-1"
|
||||
],
|
||||
"settings": {
|
||||
"syncAlerts": true
|
||||
},
|
||||
"owner": "securitySolution",
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active",
|
||||
"owner": "cases",
|
||||
"description": "A case description.",
|
||||
"duration": null,
|
||||
"severity": "low",
|
||||
"closed_at": null,
|
||||
"closed_by": null,
|
||||
"created_at": "2022-05-13T09:16:17.416Z",
|
||||
"created_by": {
|
||||
"email": "ahunley@imf.usa.gov",
|
||||
"full_name": "Alan Hunley",
|
||||
"username": "ahunley"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": null,
|
||||
|
|
@ -5061,11 +5046,9 @@
|
|||
"parent": null
|
||||
}
|
||||
},
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
|
||||
"description": "A case description.",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
"tag-1"
|
||||
],
|
||||
"settings": {
|
||||
"syncAlerts": true
|
||||
|
|
@ -5083,33 +5066,31 @@
|
|||
"comments": [],
|
||||
"totalComment": 0,
|
||||
"totalAlerts": 0,
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"title": "Case title 1",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
"tag-1"
|
||||
],
|
||||
"settings": {
|
||||
"syncAlerts": true
|
||||
},
|
||||
"owner": "securitySolution",
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
|
||||
"owner": "cases",
|
||||
"description": "A case description.",
|
||||
"duration": null,
|
||||
"severity": "low",
|
||||
"closed_at": null,
|
||||
"closed_by": null,
|
||||
"created_at": "2022-05-13T09:16:17.416Z",
|
||||
"created_by": {
|
||||
"email": "ahunley@imf.usa.gov",
|
||||
"full_name": "Alan Hunley",
|
||||
"username": "ahunley"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": "2022-05-13T09:48:33.043Z",
|
||||
"updated_by": {
|
||||
"email": "classified@hms.oo.gov.uk",
|
||||
"full_name": "Classified",
|
||||
"username": "M"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"connector": {
|
||||
"id": "131d4448-abe0-4789-939d-8ef60680b498",
|
||||
|
|
@ -5124,9 +5105,9 @@
|
|||
"external_service": {
|
||||
"external_title": "IS-4",
|
||||
"pushed_by": {
|
||||
"full_name": "Classified",
|
||||
"email": "classified@hms.oo.gov.uk",
|
||||
"username": "M"
|
||||
"full_name": null,
|
||||
"email": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"external_url": "https://hms.atlassian.net/browse/IS-4",
|
||||
"pushed_at": "2022-05-13T09:20:40.672Z",
|
||||
|
|
@ -5138,7 +5119,7 @@
|
|||
]
|
||||
},
|
||||
"find_case_response": {
|
||||
"summary": "Retrieve the first five cases with the `phishing` tag, in ascending order by last update time.",
|
||||
"summary": "Retrieve the first five cases with the `tag-1` tag, in ascending order by last update time.",
|
||||
"value": {
|
||||
"page": 1,
|
||||
"per_page": 5,
|
||||
|
|
@ -5152,29 +5133,29 @@
|
|||
"totalAlerts": 0,
|
||||
"title": "Case title",
|
||||
"tags": [
|
||||
"phishing"
|
||||
"tag-1"
|
||||
],
|
||||
"description": "Case description",
|
||||
"settings": {
|
||||
"syncAlerts": true
|
||||
},
|
||||
"owner": "securitySolution",
|
||||
"owner": "cases",
|
||||
"duration": null,
|
||||
"severity": "low",
|
||||
"closed_at": null,
|
||||
"closed_by": null,
|
||||
"created_at": "2022-05-12T00:16:36.371Z",
|
||||
"created_by": {
|
||||
"email": "jdoe@email.com",
|
||||
"full_name": "Jane Doe",
|
||||
"username": "jdoe"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": "2022-05-12T00:27:58.162Z",
|
||||
"updated_by": {
|
||||
"email": "jsmith@email.com",
|
||||
"full_name": "Joe Smith",
|
||||
"username": "jsmith"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"connector": {
|
||||
"id": "none",
|
||||
|
|
|
|||
|
|
@ -316,11 +316,7 @@ paths:
|
|||
example: elastic
|
||||
description:
|
||||
type: string
|
||||
example: >-
|
||||
James Bond clicked on a highly suspicious email banner
|
||||
advertising cheap holidays for underpaid civil servants.
|
||||
Operation bubblegum is active. Repeat - operation
|
||||
bubblegum is now active
|
||||
example: A case description.
|
||||
duration:
|
||||
type: integer
|
||||
description: >
|
||||
|
|
@ -376,12 +372,10 @@ paths:
|
|||
items:
|
||||
type: string
|
||||
example:
|
||||
- phishing
|
||||
- social engineering
|
||||
- bubblegum
|
||||
- tag-1
|
||||
title:
|
||||
type: string
|
||||
example: This case will self-destruct in 5 seconds
|
||||
example: Case title 1
|
||||
totalAlerts:
|
||||
type: integer
|
||||
example: 0
|
||||
|
|
@ -743,11 +737,7 @@ paths:
|
|||
example: elastic
|
||||
description:
|
||||
type: string
|
||||
example: >-
|
||||
James Bond clicked on a highly suspicious email banner
|
||||
advertising cheap holidays for underpaid civil servants.
|
||||
Operation bubblegum is active. Repeat - operation
|
||||
bubblegum is now active
|
||||
example: A case description.
|
||||
duration:
|
||||
type: integer
|
||||
description: >
|
||||
|
|
@ -803,12 +793,10 @@ paths:
|
|||
items:
|
||||
type: string
|
||||
example:
|
||||
- phishing
|
||||
- social engineering
|
||||
- bubblegum
|
||||
- tag-1
|
||||
title:
|
||||
type: string
|
||||
example: This case will self-destruct in 5 seconds
|
||||
example: Case title 1
|
||||
totalAlerts:
|
||||
type: integer
|
||||
example: 0
|
||||
|
|
@ -960,7 +948,7 @@ paths:
|
|||
- type: array
|
||||
items:
|
||||
type: string
|
||||
example: phishing
|
||||
example: tag-1
|
||||
- name: to
|
||||
in: query
|
||||
description: >-
|
||||
|
|
@ -1123,11 +1111,7 @@ paths:
|
|||
example: elastic
|
||||
description:
|
||||
type: string
|
||||
example: >-
|
||||
James Bond clicked on a highly suspicious email
|
||||
banner advertising cheap holidays for underpaid
|
||||
civil servants. Operation bubblegum is active.
|
||||
Repeat - operation bubblegum is now active
|
||||
example: A case description.
|
||||
duration:
|
||||
type: integer
|
||||
description: >
|
||||
|
|
@ -1184,12 +1168,10 @@ paths:
|
|||
items:
|
||||
type: string
|
||||
example:
|
||||
- phishing
|
||||
- social engineering
|
||||
- bubblegum
|
||||
- tag-1
|
||||
title:
|
||||
type: string
|
||||
example: This case will self-destruct in 5 seconds
|
||||
example: Case title 1
|
||||
totalAlerts:
|
||||
type: integer
|
||||
example: 0
|
||||
|
|
@ -2386,11 +2368,7 @@ paths:
|
|||
example: elastic
|
||||
description:
|
||||
type: string
|
||||
example: >-
|
||||
James Bond clicked on a highly suspicious email banner
|
||||
advertising cheap holidays for underpaid civil servants.
|
||||
Operation bubblegum is active. Repeat - operation
|
||||
bubblegum is now active
|
||||
example: A case description.
|
||||
duration:
|
||||
type: integer
|
||||
description: >
|
||||
|
|
@ -2446,12 +2424,10 @@ paths:
|
|||
items:
|
||||
type: string
|
||||
example:
|
||||
- phishing
|
||||
- social engineering
|
||||
- bubblegum
|
||||
- tag-1
|
||||
title:
|
||||
type: string
|
||||
example: This case will self-destruct in 5 seconds
|
||||
example: Case title 1
|
||||
totalAlerts:
|
||||
type: integer
|
||||
example: 0
|
||||
|
|
@ -2815,11 +2791,7 @@ paths:
|
|||
example: elastic
|
||||
description:
|
||||
type: string
|
||||
example: >-
|
||||
James Bond clicked on a highly suspicious email banner
|
||||
advertising cheap holidays for underpaid civil servants.
|
||||
Operation bubblegum is active. Repeat - operation
|
||||
bubblegum is now active
|
||||
example: A case description.
|
||||
duration:
|
||||
type: integer
|
||||
description: >
|
||||
|
|
@ -2875,12 +2847,10 @@ paths:
|
|||
items:
|
||||
type: string
|
||||
example:
|
||||
- phishing
|
||||
- social engineering
|
||||
- bubblegum
|
||||
- tag-1
|
||||
title:
|
||||
type: string
|
||||
example: This case will self-destruct in 5 seconds
|
||||
example: Case title 1
|
||||
totalAlerts:
|
||||
type: integer
|
||||
example: 0
|
||||
|
|
@ -3032,7 +3002,7 @@ paths:
|
|||
- type: array
|
||||
items:
|
||||
type: string
|
||||
example: phishing
|
||||
example: tag-1
|
||||
- name: to
|
||||
in: query
|
||||
description: >
|
||||
|
|
@ -3198,11 +3168,7 @@ paths:
|
|||
example: elastic
|
||||
description:
|
||||
type: string
|
||||
example: >-
|
||||
James Bond clicked on a highly suspicious email
|
||||
banner advertising cheap holidays for underpaid
|
||||
civil servants. Operation bubblegum is active.
|
||||
Repeat - operation bubblegum is now active
|
||||
example: A case description.
|
||||
duration:
|
||||
type: integer
|
||||
description: >
|
||||
|
|
@ -3259,12 +3225,10 @@ paths:
|
|||
items:
|
||||
type: string
|
||||
example:
|
||||
- phishing
|
||||
- social engineering
|
||||
- bubblegum
|
||||
- tag-1
|
||||
title:
|
||||
type: string
|
||||
example: This case will self-destruct in 5 seconds
|
||||
example: Case title 1
|
||||
totalAlerts:
|
||||
type: integer
|
||||
example: 0
|
||||
|
|
@ -4282,13 +4246,10 @@ components:
|
|||
create_case_request:
|
||||
summary: Create a security case that uses a Jira connector.
|
||||
value:
|
||||
description: >-
|
||||
James Bond clicked on a highly suspicious email banner advertising
|
||||
cheap holidays for underpaid civil servants.
|
||||
title: This case will self-destruct in 5 seconds
|
||||
description: A case description.
|
||||
title: Case title 1
|
||||
tags:
|
||||
- phishing
|
||||
- social engineering
|
||||
- tag-1
|
||||
connector:
|
||||
id: 131d4448-abe0-4789-939d-8ef60680b498
|
||||
name: My connector
|
||||
|
|
@ -4299,7 +4260,7 @@ components:
|
|||
parent: null
|
||||
settings:
|
||||
syncAlerts: true
|
||||
owner: securitySolution
|
||||
owner: cases
|
||||
create_case_response:
|
||||
summary: >-
|
||||
The create case API returns a JSON object that includes the user who
|
||||
|
|
@ -4310,27 +4271,22 @@ components:
|
|||
comments: []
|
||||
totalComment: 0
|
||||
totalAlerts: 0
|
||||
title: This case will self-destruct in 5 seconds
|
||||
title: Case title 1
|
||||
tags:
|
||||
- phishing
|
||||
- social engineering
|
||||
- bubblegum
|
||||
- tag-1
|
||||
settings:
|
||||
syncAlerts: true
|
||||
owner: securitySolution
|
||||
description: >-
|
||||
James Bond clicked on a highly suspicious email banner advertising
|
||||
cheap holidays for underpaid civil servants. Operation bubblegum is
|
||||
active. Repeat - operation bubblegum is now active
|
||||
owner: cases
|
||||
description: A case description.
|
||||
duration: null
|
||||
severity: low
|
||||
closed_at: null
|
||||
closed_by: null
|
||||
created_at: '2022-05-13T09:16:17.416Z'
|
||||
created_by:
|
||||
email: ahunley@imf.usa.gov
|
||||
full_name: Alan Hunley
|
||||
username: ahunley
|
||||
email: null
|
||||
full_name: null
|
||||
username: elastic
|
||||
status: open
|
||||
updated_at: null
|
||||
updated_by: null
|
||||
|
|
@ -4357,14 +4313,9 @@ components:
|
|||
issueType: '10006'
|
||||
priority: null
|
||||
parent: null
|
||||
description: >-
|
||||
James Bond clicked on a highly suspicious email banner advertising
|
||||
cheap holidays for underpaid civil servants. Operation bubblegum
|
||||
is active. Repeat - operation bubblegum is now active!
|
||||
description: A case description.
|
||||
tags:
|
||||
- phishing
|
||||
- social engineering
|
||||
- bubblegum
|
||||
- tag-1
|
||||
settings:
|
||||
syncAlerts: true
|
||||
update_case_response:
|
||||
|
|
@ -4377,33 +4328,28 @@ components:
|
|||
comments: []
|
||||
totalComment: 0
|
||||
totalAlerts: 0
|
||||
title: This case will self-destruct in 5 seconds
|
||||
title: Case title 1
|
||||
tags:
|
||||
- phishing
|
||||
- social engineering
|
||||
- bubblegum
|
||||
- tag-1
|
||||
settings:
|
||||
syncAlerts: true
|
||||
owner: securitySolution
|
||||
description: >-
|
||||
James Bond clicked on a highly suspicious email banner advertising
|
||||
cheap holidays for underpaid civil servants. Operation bubblegum is
|
||||
active. Repeat - operation bubblegum is now active!
|
||||
owner: cases
|
||||
description: A case description.
|
||||
duration: null
|
||||
severity: low
|
||||
closed_at: null
|
||||
closed_by: null
|
||||
created_at: '2022-05-13T09:16:17.416Z'
|
||||
created_by:
|
||||
email: ahunley@imf.usa.gov
|
||||
full_name: Alan Hunley
|
||||
username: ahunley
|
||||
email: null
|
||||
full_name: null
|
||||
username: elastic
|
||||
status: open
|
||||
updated_at: '2022-05-13T09:48:33.043Z'
|
||||
updated_by:
|
||||
email: classified@hms.oo.gov.uk
|
||||
full_name: Classified
|
||||
username: M
|
||||
email: null
|
||||
full_name: null
|
||||
username: elastic
|
||||
connector:
|
||||
id: 131d4448-abe0-4789-939d-8ef60680b498
|
||||
name: My connector
|
||||
|
|
@ -4415,9 +4361,9 @@ components:
|
|||
external_service:
|
||||
external_title: IS-4
|
||||
pushed_by:
|
||||
full_name: Classified
|
||||
email: classified@hms.oo.gov.uk
|
||||
username: M
|
||||
full_name: null
|
||||
email: null
|
||||
username: elastic
|
||||
external_url: https://hms.atlassian.net/browse/IS-4
|
||||
pushed_at: '2022-05-13T09:20:40.672Z'
|
||||
connector_id: 05da469f-1fde-4058-99a3-91e4807e2de8
|
||||
|
|
@ -4425,8 +4371,8 @@ components:
|
|||
connector_name: Jira
|
||||
find_case_response:
|
||||
summary: >-
|
||||
Retrieve the first five cases with the `phishing` tag, in ascending
|
||||
order by last update time.
|
||||
Retrieve the first five cases with the `tag-1` tag, in ascending order
|
||||
by last update time.
|
||||
value:
|
||||
page: 1
|
||||
per_page: 5
|
||||
|
|
@ -4439,26 +4385,26 @@ components:
|
|||
totalAlerts: 0
|
||||
title: Case title
|
||||
tags:
|
||||
- phishing
|
||||
- tag-1
|
||||
description: Case description
|
||||
settings:
|
||||
syncAlerts: true
|
||||
owner: securitySolution
|
||||
owner: cases
|
||||
duration: null
|
||||
severity: low
|
||||
closed_at: null
|
||||
closed_by: null
|
||||
created_at: '2022-05-12T00:16:36.371Z'
|
||||
created_by:
|
||||
email: jdoe@email.com
|
||||
full_name: Jane Doe
|
||||
username: jdoe
|
||||
email: null
|
||||
full_name: null
|
||||
username: elastic
|
||||
status: open
|
||||
updated_at: '2022-05-12T00:27:58.162Z'
|
||||
updated_by:
|
||||
email: jsmith@email.com
|
||||
full_name: Joe Smith
|
||||
username: jsmith
|
||||
email: null
|
||||
full_name: null
|
||||
username: elastic
|
||||
connector:
|
||||
id: none
|
||||
name: none
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
summary: Create a security case that uses a Jira connector.
|
||||
value:
|
||||
{
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.",
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"tags": [ "phishing","social engineering"],
|
||||
"description": "A case description.",
|
||||
"title": "Case title 1",
|
||||
"tags": [ "tag-1" ],
|
||||
"connector": {
|
||||
"id": "131d4448-abe0-4789-939d-8ef60680b498",
|
||||
"name": "My connector",
|
||||
|
|
@ -17,5 +17,5 @@ value:
|
|||
"settings": {
|
||||
"syncAlerts": true
|
||||
},
|
||||
"owner": "securitySolution"
|
||||
"owner": "cases"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6,26 +6,22 @@ value:
|
|||
"comments": [],
|
||||
"totalComment": 0,
|
||||
"totalAlerts": 0,
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
],
|
||||
"title": "Case title 1",
|
||||
"tags": [ "tag-1" ],
|
||||
"settings": {
|
||||
"syncAlerts": true
|
||||
},
|
||||
"owner": "securitySolution",
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active",
|
||||
"owner": "cases",
|
||||
"description": "A case description.",
|
||||
"duration": null,
|
||||
"severity": "low",
|
||||
"closed_at": null,
|
||||
"closed_by": null,
|
||||
"created_at": "2022-05-13T09:16:17.416Z",
|
||||
"created_by": {
|
||||
"email": "ahunley@imf.usa.gov",
|
||||
"full_name": "Alan Hunley",
|
||||
"username": "ahunley"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": null,
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
summary: Retrieve the first five cases with the `phishing` tag, in ascending order by last update time.
|
||||
summary: Retrieve the first five cases with the `tag-1` tag, in ascending order by last update time.
|
||||
value:
|
||||
{
|
||||
"page": 1,
|
||||
|
|
@ -12,26 +12,26 @@ value:
|
|||
"totalComment": 1,
|
||||
"totalAlerts": 0,
|
||||
"title": "Case title",
|
||||
"tags": [ "phishing" ],
|
||||
"tags": [ "tag-1" ],
|
||||
"description": "Case description",
|
||||
"settings": { "syncAlerts": true },
|
||||
"owner": "securitySolution",
|
||||
"owner": "cases",
|
||||
"duration": null,
|
||||
"severity": "low",
|
||||
"closed_at": null,
|
||||
"closed_by": null,
|
||||
"created_at": "2022-05-12T00:16:36.371Z",
|
||||
"created_by": {
|
||||
"email": "jdoe@email.com",
|
||||
"full_name": "Jane Doe",
|
||||
"username": "jdoe"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": "2022-05-12T00:27:58.162Z",
|
||||
"updated_by": {
|
||||
"email": "jsmith@email.com",
|
||||
"full_name": "Joe Smith",
|
||||
"username": "jsmith"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"connector": {
|
||||
"id": "none",
|
||||
|
|
|
|||
|
|
@ -15,12 +15,8 @@ value:
|
|||
"parent": null
|
||||
}
|
||||
},
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
],
|
||||
"description": "A case description.",
|
||||
"tags": [ "tag-1" ],
|
||||
"settings": {
|
||||
"syncAlerts": true
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,33 +7,29 @@ value:
|
|||
"comments": [],
|
||||
"totalComment": 0,
|
||||
"totalAlerts": 0,
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"tags": [
|
||||
"phishing",
|
||||
"social engineering",
|
||||
"bubblegum"
|
||||
],
|
||||
"title": "Case title 1",
|
||||
"tags": [ "tag-1" ],
|
||||
"settings": {
|
||||
"syncAlerts": true
|
||||
},
|
||||
"owner": "securitySolution",
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active!",
|
||||
"owner": "cases",
|
||||
"description": "A case description.",
|
||||
"duration": null,
|
||||
"severity": "low",
|
||||
"closed_at": null,
|
||||
"closed_by": null,
|
||||
"created_at": "2022-05-13T09:16:17.416Z",
|
||||
"created_by": {
|
||||
"email": "ahunley@imf.usa.gov",
|
||||
"full_name": "Alan Hunley",
|
||||
"username": "ahunley"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": "2022-05-13T09:48:33.043Z",
|
||||
"updated_by": {
|
||||
"email": "classified@hms.oo.gov.uk",
|
||||
"full_name": "Classified",
|
||||
"username": "M"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"connector": {
|
||||
"id": "131d4448-abe0-4789-939d-8ef60680b498",
|
||||
|
|
@ -48,9 +44,9 @@ value:
|
|||
"external_service": {
|
||||
"external_title": "IS-4",
|
||||
"pushed_by": {
|
||||
"full_name": "Classified",
|
||||
"email": "classified@hms.oo.gov.uk",
|
||||
"username": "M"
|
||||
"full_name": null,
|
||||
"email": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"external_url": "https://hms.atlassian.net/browse/IS-4",
|
||||
"pushed_at": "2022-05-13T09:20:40.672Z",
|
||||
|
|
|
|||
|
|
@ -41,7 +41,7 @@ created_by:
|
|||
example: elastic
|
||||
description:
|
||||
type: string
|
||||
example: "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants. Operation bubblegum is active. Repeat - operation bubblegum is now active"
|
||||
example: "A case description."
|
||||
duration:
|
||||
type: integer
|
||||
description: >
|
||||
|
|
@ -96,10 +96,10 @@ tags:
|
|||
type: array
|
||||
items:
|
||||
type: string
|
||||
example: ["phishing","social engineering","bubblegum"]
|
||||
example: ["tag-1"]
|
||||
title:
|
||||
type: string
|
||||
example: This case will self-destruct in 5 seconds
|
||||
example: Case title 1
|
||||
totalAlerts:
|
||||
type: integer
|
||||
example: 0
|
||||
|
|
|
|||
|
|
@ -85,7 +85,7 @@ delete:
|
|||
required: true
|
||||
schema:
|
||||
type: string
|
||||
example: 'd4e7abb0-b462-11ec-9a8d-698504725a43'
|
||||
example: d4e7abb0-b462-11ec-9a8d-698504725a43
|
||||
responses:
|
||||
'204':
|
||||
description: Indicates a successful call.
|
||||
|
|
|
|||
|
|
@ -112,7 +112,7 @@ get:
|
|||
- type: array
|
||||
items:
|
||||
type: string
|
||||
example: phishing
|
||||
example: tag-1
|
||||
- name: to
|
||||
in: query
|
||||
description: Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression.
|
||||
|
|
|
|||
|
|
@ -35,7 +35,7 @@ patch:
|
|||
The version of the connector. To retrieve the version value, use
|
||||
the get configuration API.
|
||||
type: string
|
||||
example: "WzIwMiwxXQ=="
|
||||
example: WzIwMiwxXQ==
|
||||
required:
|
||||
- version
|
||||
responses:
|
||||
|
|
|
|||
|
|
@ -87,7 +87,7 @@ delete:
|
|||
required: true
|
||||
schema:
|
||||
type: string
|
||||
example: 'd4e7abb0-b462-11ec-9a8d-698504725a43'
|
||||
example: d4e7abb0-b462-11ec-9a8d-698504725a43
|
||||
responses:
|
||||
'204':
|
||||
description: Indicates a successful call.
|
||||
|
|
|
|||
|
|
@ -112,7 +112,7 @@ get:
|
|||
- type: array
|
||||
items:
|
||||
type: string
|
||||
example: phishing
|
||||
example: tag-1
|
||||
- name: to
|
||||
in: query
|
||||
description: >
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ patch:
|
|||
The version of the connector. To retrieve the version value, use
|
||||
the get configuration API.
|
||||
type: string
|
||||
example: "WzIwMiwxXQ=="
|
||||
example: WzIwMiwxXQ==
|
||||
required:
|
||||
- version
|
||||
responses:
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue