---
title: "Create Case Related Event"
method: POST
path: "/connect/case/events/"
tags: ["Cases"]
---

# Create Case Related Event

`POST /connect/case/events/`

Attach a related event to an existing case.

## Request body

- ModelAttachEventCriteria
  - `acknowledged` boolean — Whether to attach events that are already acknowledged: true = act on acknowledged events, false = act on unacknowledged events
  - `caseId` string, required — The case ID for which this related event is to be attached, or is already attached.
  - `dateRange` string — The date range to use for searching for matching events
  - `dateRangeFormat` string — The date range format. If unsure how to use this then use the example value exactly as shown.
  - `escalated` boolean — Whether to attach events that are already escalated to a case: true = act on escalated events, false = act on unescalated events
  - `fields` object, required — A mapping of related event field names and their values.
  - `timezone` string — The timezone to use with the date range

## Response `202`

Returns the bulk operation response

- ServerBulkResp
  - `count` integer — The count of detections that were submitted to be updated or deleted in bulk

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `405` — Case module not configured on server
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/versions/0576ce393f8d/schema)