mirror of
https://github.com/elastic/kibana.git
synced 2025-04-23 17:28:26 -04:00
Co-authored-by: Lisa Cawley <lcawley@elastic.co>
(cherry picked from commit b05f8c1240)
Co-authored-by: István Zoltán Szabó <szabosteve@gmail.com>
This commit is contained in:
Kibana Machine
GitHub
parent
bb660ed877
commit
ba70bdf9fe
24 changed files with 4311 additions and 86 deletions
|
|
@ -4,7 +4,7 @@
|
|||
<titleabbrev>Add comment</titleabbrev>
|
||||
++++
|
||||
|
||||
Adds a comment to a case.
|
||||
Adds a comment or alert to a case.
|
||||
|
||||
=== {api-request-title}
|
||||
|
||||
|
|
@ -78,7 +78,7 @@ Add a comment to case ID `293f1bc0-74f6-11ea-b83a-553aecdb28b6`:
|
|||
POST api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/comments
|
||||
{
|
||||
"type": "user",
|
||||
"comment": "That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives.",
|
||||
"comment": "A new comment.",
|
||||
"owner": "cases"
|
||||
}
|
||||
--------------------------------------------------
|
||||
|
|
@ -93,30 +93,30 @@ The API returns details about the case and its comments. For example:
|
|||
{
|
||||
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version": "WzIwNDMxLDFd",
|
||||
"type":"user",
|
||||
"owner":"cases",
|
||||
"comment":"That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives.",
|
||||
"created_at":"2022-03-24T00:49:47.716Z",
|
||||
"type": "user",
|
||||
"owner": "cases",
|
||||
"comment": "A new comment.",
|
||||
"created_at": "2022-03-24T00:49:47.716Z",
|
||||
"created_by": {
|
||||
"email": "moneypenny@hms.gov.uk",
|
||||
"full_name": "Ms Moneypenny",
|
||||
"username": "moneypenny"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"pushed_at":null,
|
||||
"pushed_by":null,
|
||||
"updated_at":null,
|
||||
"updated_by":null
|
||||
"pushed_at": null,
|
||||
"pushed_by": null,
|
||||
"updated_at": null,
|
||||
"updated_by": null
|
||||
}
|
||||
],
|
||||
"totalAlerts":0,
|
||||
"id":"293f1bc0-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version":"WzIzMzgsMV0=",
|
||||
"totalComment":1,
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"tags": ["phishing","social engineering"],
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.",
|
||||
"totalAlerts": 0,
|
||||
"id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version": "WzIzMzgsMV0=",
|
||||
"totalComment": 1,
|
||||
"title": "Case title 1",
|
||||
"tags": ["tag 1"],
|
||||
"description": "A case description.",
|
||||
"settings": {
|
||||
"syncAlerts":false
|
||||
"syncAlerts": false
|
||||
},
|
||||
"owner": "cases",
|
||||
"duration": null,
|
||||
|
|
@ -125,16 +125,16 @@ The API returns details about the case and its comments. For example:
|
|||
"closed_by": null,
|
||||
"created_at": "2022-03-24T00:37:03.906Z",
|
||||
"created_by": {
|
||||
"email": "ahunley@imf.usa.gov",
|
||||
"full_name": "Alan Hunley",
|
||||
"username": "ahunley"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": "2022-03-24T00:49:47.716Z",
|
||||
"updated_by": {
|
||||
"email": "moneypenny@hms.gov.uk",
|
||||
"full_name": "Ms Moneypenny",
|
||||
"username": "moneypenny"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"connector": {
|
||||
"id": "none",
|
||||
|
|
@ -152,13 +152,13 @@ Add an alert to the case:
|
|||
--------------------------------------------------
|
||||
POST api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/comments
|
||||
{
|
||||
"alertId": "6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42",
|
||||
"index": ".internal.alerts-security.alerts-default-000001",
|
||||
"type": "alert",
|
||||
"owner": "cases",
|
||||
"rule": {
|
||||
"id":"94d80550-aaf4-11ec-985f-97e55adae8b9",
|
||||
"name":"security_rule"
|
||||
"alertId": "6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42",
|
||||
"index": ".internal.alerts-security.alerts-default-000001",
|
||||
"type": "alert",
|
||||
"owner": "cases",
|
||||
"rule": {
|
||||
"id":"94d80550-aaf4-11ec-985f-97e55adae8b9",
|
||||
"name":"security_rule"
|
||||
}
|
||||
}
|
||||
--------------------------------------------------
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
<titleabbrev>Delete comments</titleabbrev>
|
||||
++++
|
||||
|
||||
Deletes one or all comments from a case.
|
||||
Deletes one or all comments and alerts from a case.
|
||||
|
||||
=== {api-request-title}
|
||||
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
<titleabbrev>Update comment</titleabbrev>
|
||||
++++
|
||||
|
||||
Updates a comment in a case.
|
||||
Updates a comment or alert in a case.
|
||||
|
||||
=== {api-request-title}
|
||||
|
||||
|
|
@ -40,7 +40,8 @@ default space is used.
|
|||
`user`.
|
||||
|
||||
`id`::
|
||||
(Required, string) The identifier for the comment. To retrieve comment IDs, use <<cases-api-get-comments>>.
|
||||
(Required, string) The identifier for the comment. To retrieve comment IDs, use
|
||||
<<cases-api-get-comments>>.
|
||||
|
||||
`index`::
|
||||
(Required*, string) The alert index. It is required only when `type` is `alert`.
|
||||
|
|
@ -74,7 +75,8 @@ The rule that is associated with the alert. It is required only when `type` is
|
|||
NOTE: You cannot change the comment type.
|
||||
|
||||
`version`::
|
||||
(Required, string) The current comment version. To retrieve version values, use <<cases-api-get-comments>>.
|
||||
(Required, string) The current comment version. To retrieve version values, use
|
||||
<<cases-api-get-comments>>.
|
||||
|
||||
=== {api-response-codes-title}
|
||||
|
||||
|
|
@ -93,7 +95,7 @@ PATCH api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/comments
|
|||
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version": "Wzk1LDFd",
|
||||
"type": "user",
|
||||
"comment": "That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives. Even worse, he likes baked beans."
|
||||
"comment": "An updated comment."
|
||||
}
|
||||
--------------------------------------------------
|
||||
// KIBANA
|
||||
|
|
@ -106,22 +108,22 @@ The API returns details about the case and its comments. For example:
|
|||
"comments":[{
|
||||
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version": "WzIwNjM3LDFd",
|
||||
"comment": "That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives. Even worse, he likes baked beans.",
|
||||
"comment": "An updated comment.",
|
||||
"type": "user",
|
||||
"owner": "cases",
|
||||
"created_at": "2022-03-24T00:37:10.832Z",
|
||||
"created_by": {
|
||||
"email": "moneypenny@hms.gov.uk",
|
||||
"full_name": "Ms Moneypenny",
|
||||
"username": "moneypenny"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"pushed_at": null,
|
||||
"pushed_by": null,
|
||||
"updated_at": "2022-03-24T01:27:06.210Z",
|
||||
"updated_by": {
|
||||
"email": "jbond@hms.gov.uk",
|
||||
"full_name": "James Bond",
|
||||
"username": "_007"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
}
|
||||
}
|
||||
],
|
||||
|
|
@ -129,9 +131,9 @@ The API returns details about the case and its comments. For example:
|
|||
"id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version": "WzIwNjM2LDFd",
|
||||
"totalComment": 1,
|
||||
"title": "This case will self-destruct in 5 seconds",
|
||||
"tags": ["phishing","social engineering"],
|
||||
"description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.",
|
||||
"title": "Case title 1",
|
||||
"tags": ["tag 1"],
|
||||
"description": "A case description.",
|
||||
"settings": {"syncAlerts":false},
|
||||
"owner": "cases",
|
||||
"duration": null,
|
||||
|
|
@ -140,18 +142,23 @@ The API returns details about the case and its comments. For example:
|
|||
"closed_by": null,
|
||||
"created_at": "2022-03-24T00:37:03.906Z",
|
||||
"created_by": {
|
||||
"email": "ahunley@imf.usa.gov",
|
||||
"full_name": "Alan Hunley",
|
||||
"username": "ahunley"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": "2022-03-24T01:27:06.210Z",
|
||||
"updated_by": {
|
||||
"email": "jbond@hms.gov.uk",
|
||||
"full_name": "James Bond",
|
||||
"username": "_007"
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"connector": {
|
||||
"id": "none",
|
||||
"name": "none",
|
||||
"type": ".none",
|
||||
"fields": null
|
||||
},
|
||||
"connector": {"id":"none","name":"none","type":".none","fields":null},
|
||||
"external_service": null
|
||||
}
|
||||
--------------------------------------------------
|
||||
|
|
@ -162,16 +169,16 @@ Update an alert in the case:
|
|||
--------------------------------------------------
|
||||
PATCH api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/comments
|
||||
{
|
||||
"id": "73362370-ab1a-11ec-985f-97e55adae8b9",
|
||||
"version": "WzMwNDgsMV0=",
|
||||
"type": "alert",
|
||||
"owner": "cases",
|
||||
"alertId": "c8789278659fdf88b7bf7709b90a082be070d0ba4c23c9c4b552e476c2a667c4",
|
||||
"index": ".internal.alerts-security.alerts-default-000001",
|
||||
"rule":
|
||||
{
|
||||
"id":"94d80550-aaf4-11ec-985f-97e55adae8b9",
|
||||
"name":"security_rule"
|
||||
"id": "73362370-ab1a-11ec-985f-97e55adae8b9",
|
||||
"version": "WzMwNDgsMV0=",
|
||||
"type": "alert",
|
||||
"owner": "cases",
|
||||
"alertId": "c8789278659fdf88b7bf7709b90a082be070d0ba4c23c9c4b552e476c2a667c4",
|
||||
"index": ".internal.alerts-security.alerts-default-000001",
|
||||
"rule":
|
||||
{
|
||||
"id":"94d80550-aaf4-11ec-985f-97e55adae8b9",
|
||||
"name":"security_rule"
|
||||
}
|
||||
}
|
||||
--------------------------------------------------
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,7 @@
|
|||
summary: Adds a comment to a case.
|
||||
value:
|
||||
{
|
||||
"type": "user",
|
||||
"comment": "A new comment.",
|
||||
"owner": "cases"
|
||||
}
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
summary: The add comment to case API returns a JSON object that contains details about the case and its comments.
|
||||
value:
|
||||
{
|
||||
"comments":[
|
||||
{
|
||||
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version": "WzIwNDMxLDFd",
|
||||
"type":"user",
|
||||
"owner":"cases",
|
||||
"comment":"A new comment.",
|
||||
"created_at":"2022-06-02T00:49:47.716Z",
|
||||
"created_by": {
|
||||
"username": "elastic",
|
||||
"email": null,
|
||||
"full_name": null
|
||||
},
|
||||
"pushed_at":null,
|
||||
"pushed_by":null,
|
||||
"updated_at":null,
|
||||
"updated_by":null
|
||||
}
|
||||
],
|
||||
"totalAlerts":0,
|
||||
"id":"293f1bc0-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version":"WzIzMzgsMV0=",
|
||||
"totalComment":1,
|
||||
"title": "Case title 1",
|
||||
"tags": ["tag 1"],
|
||||
"description": "A case description.",
|
||||
"settings": {
|
||||
"syncAlerts":false
|
||||
},
|
||||
"owner": "cases",
|
||||
"duration": null,
|
||||
"severity": "low",
|
||||
"closed_at": null,
|
||||
"closed_by": null,
|
||||
"created_at": "2022-03-24T00:37:03.906Z",
|
||||
"created_by": {
|
||||
"email": null,
|
||||
"full_name": null,
|
||||
"username": "elastic"
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": "2022-06-03T00:49:47.716Z",
|
||||
"updated_by": {
|
||||
"username": "elastic",
|
||||
"email": null,
|
||||
"full_name": null
|
||||
},
|
||||
"connector": {
|
||||
"id": "none",
|
||||
"name": "none",
|
||||
"type": ".none",
|
||||
"fields": null
|
||||
},
|
||||
"external_service": null
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
summary: Updates a comment of a case.
|
||||
value:
|
||||
{
|
||||
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version": "Wzk1LDFd",
|
||||
"type": "user",
|
||||
"comment": "An updated comment."
|
||||
}
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
summary: The add comment to case API returns a JSON object that contains details about the case and its comments.
|
||||
value:
|
||||
{
|
||||
"comments":[{
|
||||
"id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version": "WzIwNjM3LDFd",
|
||||
"comment": "An updated comment.",
|
||||
"type": "user",
|
||||
"owner": "cases",
|
||||
"created_at": "2022-03-24T00:37:10.832Z",
|
||||
"created_by": {
|
||||
"username": "elastic",
|
||||
"full_name": null,
|
||||
"email": null
|
||||
},
|
||||
"pushed_at": null,
|
||||
"pushed_by": null,
|
||||
"updated_at": "2022-03-24T01:27:06.210Z",
|
||||
"updated_by": {
|
||||
"username": "elastic",
|
||||
"full_name": null,
|
||||
"email": null
|
||||
}
|
||||
}
|
||||
],
|
||||
"totalAlerts": 0,
|
||||
"id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
|
||||
"version": "WzIwNjM2LDFd",
|
||||
"totalComment": 1,
|
||||
"title": "Case title 1",
|
||||
"tags": ["tag 1"],
|
||||
"description": "A case description.",
|
||||
"settings": {"syncAlerts":false},
|
||||
"owner": "cases",
|
||||
"duration": null,
|
||||
"severity": "low",
|
||||
"closed_at": null,
|
||||
"closed_by": null,
|
||||
"created_at": "2022-03-24T00:37:03.906Z",
|
||||
"created_by": {
|
||||
"username": "elastic",
|
||||
"full_name": null,
|
||||
"email": null
|
||||
},
|
||||
"status": "open",
|
||||
"updated_at": "2022-03-24T01:27:06.210Z",
|
||||
"updated_by": {
|
||||
"username": "elastic",
|
||||
"full_name": null,
|
||||
"email": null
|
||||
},
|
||||
"connector": {
|
||||
"id": "none",
|
||||
"name": "none",
|
||||
"type": ".none",
|
||||
"fields": null
|
||||
},
|
||||
"external_service": null
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
in: path
|
||||
name: caseId
|
||||
description: The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded.
|
||||
required: true
|
||||
schema:
|
||||
type: string
|
||||
example: '9c235210-6834-11ea-a78c-6ffb38a34414'
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
in: path
|
||||
name: commentId
|
||||
description: The identifier for the comment. To retrieve comment IDs, use the get case or find cases APIs. If it is not specified, all comments are deleted.
|
||||
required: false
|
||||
schema:
|
||||
type: string
|
||||
example: '71ec1870-725b-11ea-a0b2-c51ea50a58e2'
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
type: object
|
||||
properties:
|
||||
alertId:
|
||||
description: >
|
||||
The alert identifier. It is required only when `type` is `alert`. This
|
||||
functionality is in technical preview and may be changed or removed in a
|
||||
future release. Elastic will apply best effort to fix any issues, but
|
||||
features in technical preview are not subject to the support SLA of
|
||||
official GA features.
|
||||
type: string
|
||||
x-technical-preview: true
|
||||
example: 6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42
|
||||
index:
|
||||
description: >
|
||||
The alert index. It is required only when `type` is `alert`. This
|
||||
functionality is in technical preview and may be changed or removed in a
|
||||
future release. Elastic will apply best effort to fix any issues, but
|
||||
features in technical preview are not subject to the support SLA of
|
||||
official GA features.
|
||||
type: string
|
||||
x-technical-preview: true
|
||||
owner:
|
||||
$ref: 'owners.yaml'
|
||||
rule:
|
||||
description: >
|
||||
The rule that is associated with the alert. It is required only when
|
||||
`type` is `alert`. This functionality is in technical preview and may be
|
||||
changed or removed in a future release. Elastic will apply best effort to
|
||||
fix any issues, but features in technical preview are not subject to the
|
||||
support SLA of official GA features.
|
||||
type: object
|
||||
x-technical-preview: true
|
||||
properties:
|
||||
id:
|
||||
description: The rule identifier.
|
||||
type: string
|
||||
x-technical-preview: true
|
||||
example: 94d80550-aaf4-11ec-985f-97e55adae8b9
|
||||
name:
|
||||
description: The rule name.
|
||||
type: string
|
||||
x-technical-preview: true
|
||||
example: security_rule
|
||||
type:
|
||||
description: The type of comment.
|
||||
type: string
|
||||
enum:
|
||||
- alert
|
||||
example: alert
|
||||
required:
|
||||
- alertId
|
||||
- index
|
||||
- owner
|
||||
- rule
|
||||
- type
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
type: object
|
||||
properties:
|
||||
comment:
|
||||
description: The new comment. It is required only when `type` is `user`.
|
||||
type: string
|
||||
example: A new comment.
|
||||
owner:
|
||||
$ref: 'owners.yaml'
|
||||
type:
|
||||
type: string
|
||||
description: The type of comment.
|
||||
enum:
|
||||
- user
|
||||
example: user
|
||||
required:
|
||||
- comment
|
||||
- owner
|
||||
- type
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
|
||||
type: object
|
||||
properties:
|
||||
alertId:
|
||||
type: string
|
||||
example: 6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42
|
||||
created_at:
|
||||
type: string
|
||||
format: date-time
|
||||
example: 2022-03-24T02:31:03.210Z
|
||||
created_by:
|
||||
type: object
|
||||
properties:
|
||||
email:
|
||||
type: string
|
||||
example: null
|
||||
full_name:
|
||||
type: string
|
||||
example: null
|
||||
username:
|
||||
type: string
|
||||
example: elastic
|
||||
id:
|
||||
type: string
|
||||
example: 73362370-ab1a-11ec-985f-97e55adae8b9
|
||||
index:
|
||||
type: string
|
||||
example: .internal.alerts-security.alerts-default-000001
|
||||
owner:
|
||||
$ref: 'owners.yaml'
|
||||
pushed_at:
|
||||
type: string
|
||||
format: date-time
|
||||
example: null
|
||||
nullable: true
|
||||
pushed_by:
|
||||
type: object
|
||||
properties:
|
||||
email:
|
||||
type: string
|
||||
example: null
|
||||
full_name:
|
||||
type: string
|
||||
example: null
|
||||
username:
|
||||
type: string
|
||||
example: elastic
|
||||
nullable: true
|
||||
rule:
|
||||
type: object
|
||||
properties:
|
||||
id:
|
||||
type: string
|
||||
example: 94d80550-aaf4-11ec-985f-97e55adae8b9
|
||||
name:
|
||||
type: string
|
||||
example: security_rule
|
||||
type:
|
||||
type: string
|
||||
example: alert
|
||||
updated_at:
|
||||
type: string
|
||||
format: date-time
|
||||
example: null
|
||||
updated_by:
|
||||
type: object
|
||||
properties:
|
||||
email:
|
||||
type: string
|
||||
example: null
|
||||
full_name:
|
||||
type: string
|
||||
example: null
|
||||
username:
|
||||
type: string
|
||||
example: elastic
|
||||
version:
|
||||
type: string
|
||||
example: WzMwNDgsMV0=
|
||||
|
|
@ -17,7 +17,9 @@ closed_by:
|
|||
comments:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
oneOf:
|
||||
- $ref: 'alert_comment_response_properties.yaml'
|
||||
- $ref: 'user_comment_response_properties.yaml'
|
||||
example: []
|
||||
connector:
|
||||
type: object
|
||||
|
|
|
|||
|
|
@ -2,4 +2,5 @@ type: string
|
|||
description: The type of comment.
|
||||
enum:
|
||||
- alert
|
||||
- user
|
||||
- user
|
||||
example: user
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
type: object
|
||||
properties:
|
||||
alertId:
|
||||
description: >
|
||||
The alert identifier. It is required only when `type` is `alert`. This
|
||||
functionality is in technical preview and may be changed or removed in a
|
||||
future release. Elastic will apply best effort to fix any issues, but
|
||||
features in technical preview are not subject to the support SLA of
|
||||
official GA features.
|
||||
type: string
|
||||
x-technical-preview: true
|
||||
example: 6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42
|
||||
id:
|
||||
type: string
|
||||
description: >
|
||||
The identifier for the comment. To retrieve comment IDs, use the
|
||||
get comments API.
|
||||
example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
|
||||
index:
|
||||
description: >
|
||||
The alert index. It is required only when `type` is `alert`. This
|
||||
functionality is in technical preview and may be changed or removed in a
|
||||
future release. Elastic will apply best effort to fix any issues, but
|
||||
features in technical preview are not subject to the support SLA of
|
||||
official GA features.
|
||||
type: string
|
||||
x-technical-preview: true
|
||||
owner:
|
||||
$ref: 'owners.yaml'
|
||||
rule:
|
||||
description: >
|
||||
The rule that is associated with the alert. It is required only when
|
||||
`type` is `alert`. This functionality is in technical preview and may be
|
||||
changed or removed in a future release. Elastic will apply best effort to
|
||||
fix any issues, but features in technical preview are not subject to the
|
||||
support SLA of official GA features.
|
||||
type: object
|
||||
x-technical-preview: true
|
||||
properties:
|
||||
id:
|
||||
description: The rule identifier.
|
||||
type: string
|
||||
x-technical-preview: true
|
||||
example: 94d80550-aaf4-11ec-985f-97e55adae8b9
|
||||
name:
|
||||
description: The rule name.
|
||||
type: string
|
||||
x-technical-preview: true
|
||||
example: security_rule
|
||||
type:
|
||||
description: The type of comment.
|
||||
type: string
|
||||
enum:
|
||||
- alert
|
||||
example: alert
|
||||
version:
|
||||
description: >
|
||||
The current comment version. To retrieve version values, use the get
|
||||
comments API.
|
||||
type: string
|
||||
example: Wzk1LDFd
|
||||
required:
|
||||
- alertId
|
||||
- id
|
||||
- index
|
||||
- owner
|
||||
- rule
|
||||
- type
|
||||
- version
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
type: object
|
||||
properties:
|
||||
comment:
|
||||
description: The new comment. It is required only when `type` is `user`.
|
||||
type: string
|
||||
example: A new comment.
|
||||
id:
|
||||
type: string
|
||||
description: >
|
||||
The identifier for the comment. To retrieve comment IDs, use the
|
||||
get comments API.
|
||||
example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
|
||||
owner:
|
||||
$ref: 'owners.yaml'
|
||||
type:
|
||||
type: string
|
||||
description: The type of comment.
|
||||
enum:
|
||||
- user
|
||||
example: user
|
||||
version:
|
||||
description: >
|
||||
The current comment version. To retrieve version values, use the get
|
||||
comments API.
|
||||
type: string
|
||||
example: Wzk1LDFd
|
||||
required:
|
||||
- comment
|
||||
- id
|
||||
- owner
|
||||
- type
|
||||
- version
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
type: object
|
||||
properties:
|
||||
comment:
|
||||
type: string
|
||||
example: A new comment.
|
||||
created_at:
|
||||
type: string
|
||||
format: date-time
|
||||
example: 2022-05-13T09:16:17.416Z
|
||||
created_by:
|
||||
type: object
|
||||
properties:
|
||||
email:
|
||||
type: string
|
||||
example: null
|
||||
full_name:
|
||||
type: string
|
||||
example: null
|
||||
username:
|
||||
type: string
|
||||
example: elastic
|
||||
id:
|
||||
type: string
|
||||
example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
|
||||
owner:
|
||||
$ref: 'owners.yaml'
|
||||
pushed_at:
|
||||
type: string
|
||||
format: date-time
|
||||
nullable: true
|
||||
example: null
|
||||
pushed_by:
|
||||
type: object
|
||||
properties:
|
||||
email:
|
||||
type: string
|
||||
full_name:
|
||||
type: string
|
||||
username:
|
||||
type: string
|
||||
nullable: true
|
||||
example: null
|
||||
type:
|
||||
type: string
|
||||
example: user
|
||||
updated_at:
|
||||
type: string
|
||||
format: date-time
|
||||
nullable: true
|
||||
example: null
|
||||
updated_by:
|
||||
type: object
|
||||
properties:
|
||||
email:
|
||||
type: string
|
||||
full_name:
|
||||
type: string
|
||||
username:
|
||||
type: string
|
||||
nullable: true
|
||||
example: null
|
||||
version:
|
||||
type: string
|
||||
example: WzIwNDMxLDFd
|
||||
|
|
@ -39,8 +39,8 @@ paths:
|
|||
# $ref: 'paths/api@cases@{caseid}.yaml'
|
||||
# '/api/cases/{caseId}/alerts':
|
||||
# $ref: 'paths/api@cases@{caseid}@alerts.yaml'
|
||||
# '/api/cases/{caseId}/comments':
|
||||
# $ref: 'paths/api@cases@{caseid}@comments.yaml'
|
||||
'/api/cases/{caseId}/comments':
|
||||
$ref: 'paths/api@cases@{caseid}@comments.yaml'
|
||||
# '/api/cases/{caseId}/comments/{commentId}':
|
||||
# $ref: 'paths/api@cases@{caseid}@comments@{commentid}.yaml'
|
||||
# '/api/cases/{caseId}/connector/{connectorId}/_push':
|
||||
|
|
@ -70,10 +70,10 @@ paths:
|
|||
# $ref: 'paths/s@{spaceid}@api@cases@{caseid}.yaml'
|
||||
# '/s/{spaceId}/api/cases/{caseId}/alerts':
|
||||
# $ref: 'paths/s@{spaceid}@api@cases@{caseid}@alerts.yaml'
|
||||
# '/s/{spaceId}/api/cases/{caseId}/comments':
|
||||
# $ref: 'paths/s@{spaceid}@api@cases@{caseid}@comments.yaml'
|
||||
# '/s/{spaceId}/api/cases/{caseId}/comments/{commentId}':
|
||||
# $ref: 'paths/s@{spaceid}@api@cases@{caseid}@comments@{commentid}.yaml'
|
||||
'/s/{spaceId}/api/cases/{caseId}/comments':
|
||||
$ref: 'paths/s@{spaceid}@api@cases@{caseid}@comments.yaml'
|
||||
# '/s/{spaceId}/api/cases/{caseId}/comments/{commentId}':
|
||||
# $ref: 'paths/s@{spaceid}@api@cases@{caseid}@comments@{commentid}.yaml'
|
||||
# '/s/{spaceId}/api/cases/{caseId}/connector/{connectorId}/_push':
|
||||
# $ref: 'paths/s@{spaceid}@api@cases@{caseid}@connector@{connectorid}@_push.yaml'
|
||||
# '/s/{spaceId}/api/cases/{caseId}/user_actions':
|
||||
|
|
|
|||
|
|
@ -0,0 +1,95 @@
|
|||
post:
|
||||
summary: Adds a comment or alert to a case.
|
||||
description: >
|
||||
You must have `all` privileges for the **Cases** feature in the
|
||||
**Management**, **Observability**, or **Security** section of the Kibana
|
||||
feature privileges, depending on the owner of the case you're creating.
|
||||
tags:
|
||||
- cases
|
||||
- kibana
|
||||
parameters:
|
||||
- $ref: '../components/headers/kbn_xsrf.yaml'
|
||||
- $ref: '../components/parameters/case_id.yaml'
|
||||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
oneOf:
|
||||
- $ref: '../components/schemas/add_alert_comment_request_properties.yaml'
|
||||
- $ref: '../components/schemas/add_user_comment_request_properties.yaml'
|
||||
examples:
|
||||
createCaseCommentRequest:
|
||||
$ref: '../components/examples/add_comment_request.yaml'
|
||||
responses:
|
||||
'200':
|
||||
description: Indicates a successful call.
|
||||
content:
|
||||
application/json; charset=utf-8:
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
$ref: '../components/schemas/case_response_properties.yaml'
|
||||
examples:
|
||||
createCaseCommentResponse:
|
||||
$ref: '../components/examples/add_comment_response.yaml'
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
||||
delete:
|
||||
summary: Deletes all comments and alerts from a case.
|
||||
description: >
|
||||
You must have `all` privileges for the **Cases** feature in the
|
||||
**Management**, **Observability**, or **Security** section of the Kibana
|
||||
feature privileges, depending on the owner of the cases you're deleting.
|
||||
tags:
|
||||
- cases
|
||||
- kibana
|
||||
parameters:
|
||||
- $ref: '../components/headers/kbn_xsrf.yaml'
|
||||
- $ref: '../components/parameters/case_id.yaml'
|
||||
responses:
|
||||
'204':
|
||||
description: Indicates a successful call.
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
||||
patch:
|
||||
summary: Updates a comment or alert in a case.
|
||||
description: >
|
||||
You must have `all` privileges for the **Cases** feature in the
|
||||
**Management**, **Observability**, or **Security** section of the Kibana
|
||||
feature privileges, depending on the owner of the case you're updating.
|
||||
NOTE: You cannot change the comment type or the owner of a comment.
|
||||
tags:
|
||||
- cases
|
||||
- kibana
|
||||
parameters:
|
||||
- $ref: '../components/headers/kbn_xsrf.yaml'
|
||||
- $ref: '../components/parameters/case_id.yaml'
|
||||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
oneOf:
|
||||
- $ref: '../components/schemas/update_alert_comment_request_properties.yaml'
|
||||
- $ref: '../components/schemas/update_user_comment_request_properties.yaml'
|
||||
examples:
|
||||
updateCaseCommentRequest:
|
||||
$ref: '../components/examples/update_comment_request.yaml'
|
||||
responses:
|
||||
'200':
|
||||
description: Indicates a successful call.
|
||||
content:
|
||||
application/json; charset=utf-8:
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
$ref: '../components/schemas/case_response_properties.yaml'
|
||||
examples:
|
||||
updateCaseCommentResponse:
|
||||
$ref: '../components/examples/update_comment_response.yaml'
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
delete:
|
||||
summary: Deletes a comment or alert from a case.
|
||||
description: >
|
||||
You must have `all` privileges for the **Cases** feature in the
|
||||
**Management**, **Observability**, or **Security** section of the Kibana
|
||||
feature privileges, depending on the owner of the cases you're deleting.
|
||||
tags:
|
||||
- cases
|
||||
- kibana
|
||||
parameters:
|
||||
- $ref: '../components/headers/kbn_xsrf.yaml'
|
||||
- $ref: '../components/parameters/case_id.yaml'
|
||||
- $ref: '../components/parameters/comment_id.yaml'
|
||||
responses:
|
||||
'204':
|
||||
description: Indicates a successful call.
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
post:
|
||||
summary: Adds a comment or alert to a case.
|
||||
description: >
|
||||
You must have `all` privileges for the **Cases** feature in the
|
||||
**Management**, **Observability**, or **Security** section of the Kibana
|
||||
feature privileges, depending on the owner of the case you're creating.
|
||||
tags:
|
||||
- cases
|
||||
- kibana
|
||||
parameters:
|
||||
- $ref: '../components/headers/kbn_xsrf.yaml'
|
||||
- $ref: '../components/parameters/case_id.yaml'
|
||||
- $ref: '../components/parameters/space_id.yaml'
|
||||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
oneOf:
|
||||
- $ref: '../components/schemas/add_alert_comment_request_properties.yaml'
|
||||
- $ref: '../components/schemas/add_user_comment_request_properties.yaml'
|
||||
examples:
|
||||
createCaseCommentRequest:
|
||||
$ref: '../components/examples/add_comment_request.yaml'
|
||||
responses:
|
||||
'200':
|
||||
description: Indicates a successful call.
|
||||
content:
|
||||
application/json; charset=utf-8:
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
$ref: '../components/schemas/case_response_properties.yaml'
|
||||
examples:
|
||||
createCaseCommentResponse:
|
||||
$ref: '../components/examples/add_comment_response.yaml'
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
||||
delete:
|
||||
summary: Deletes all comments and alerts from a case.
|
||||
description: >
|
||||
You must have `all` privileges for the **Cases** feature in the
|
||||
**Management**, **Observability**, or **Security** section of the Kibana
|
||||
feature privileges, depending on the owner of the cases you're deleting.
|
||||
tags:
|
||||
- cases
|
||||
- kibana
|
||||
parameters:
|
||||
- $ref: '../components/headers/kbn_xsrf.yaml'
|
||||
- $ref: '../components/parameters/case_id.yaml'
|
||||
- $ref: '../components/parameters/space_id.yaml'
|
||||
responses:
|
||||
'204':
|
||||
description: Indicates a successful call.
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
||||
patch:
|
||||
summary: Updates a comment or alert in a case.
|
||||
description: >
|
||||
You must have `all` privileges for the **Cases** feature in the
|
||||
**Management**, **Observability**, or **Security** section of the Kibana
|
||||
feature privileges, depending on the owner of the case you're updating.
|
||||
NOTE: You cannot change the comment type or the owner of a comment.
|
||||
tags:
|
||||
- cases
|
||||
- kibana
|
||||
parameters:
|
||||
- $ref: '../components/headers/kbn_xsrf.yaml'
|
||||
- $ref: '../components/parameters/case_id.yaml'
|
||||
- $ref: '../components/parameters/space_id.yaml'
|
||||
requestBody:
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
oneOf:
|
||||
- $ref: '../components/schemas/update_alert_comment_request_properties.yaml'
|
||||
- $ref: '../components/schemas/update_user_comment_request_properties.yaml'
|
||||
examples:
|
||||
updateCaseCommentRequest:
|
||||
$ref: '../components/examples/update_comment_request.yaml'
|
||||
responses:
|
||||
'200':
|
||||
description: Indicates a successful call.
|
||||
content:
|
||||
application/json; charset=utf-8:
|
||||
schema:
|
||||
type: object
|
||||
properties:
|
||||
$ref: '../components/schemas/case_response_properties.yaml'
|
||||
examples:
|
||||
updateCaseCommentResponse:
|
||||
$ref: '../components/examples/update_comment_response.yaml'
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
delete:
|
||||
summary: Deletes a comment or alert from a case.
|
||||
description: >
|
||||
You must have `all` privileges for the **Cases** feature in the
|
||||
**Management**, **Observability**, or **Security** section of the Kibana
|
||||
feature privileges, depending on the owner of the cases you're deleting.
|
||||
tags:
|
||||
- cases
|
||||
- kibana
|
||||
parameters:
|
||||
- $ref: '../components/headers/kbn_xsrf.yaml'
|
||||
- $ref: '../components/parameters/case_id.yaml'
|
||||
- $ref: '../components/parameters/comment_id.yaml'
|
||||
- $ref: '../components/parameters/space_id.yaml'
|
||||
responses:
|
||||
'204':
|
||||
description: Indicates a successful call.
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
|
||||
servers:
|
||||
- url: https://localhost:5601
|
||||
Loading…
Add table
Add a link
Reference in a new issue