v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB

Cases

Create Case Related Event

Attach a related event to an existing case.

post/connect/case/events/

Request body

acknowledgedboolean

Whether to attach events that are already acknowledged: true = act on acknowledged events, false = act on unacknowledged events

caseIdstring required

The case ID for which this related event is to be attached, or is already attached.

dateRangestring

The date range to use for searching for matching events

dateRangeFormatstring

The date range format. If unsure how to use this then use the example value exactly as shown.

escalatedboolean

Whether to attach events that are already escalated to a case: true = act on escalated events, false = act on unescalated events

fieldsobject required

A mapping of related event field names and their values.

timezonestring

The timezone to use with the date range

Example request

{
  "acknowledged": true,
  "caseId": "PdFc-JIBLkNJ8-bDfz47",
  "dateRange": "2024/12/03 02:31:35 PM - 2024/12/04 02:31:35 PM",
  "dateRangeFormat": "2006/01/02 3:04:05 PM",
  "fields": {
    "client.ip": "1.2.3.4",
    "client.port": "1099"
  },
  "timezone": "America/New_York"
}

Response

Returns the bulk operation response

countinteger

The count of detections that were submitted to be updated or deleted in bulk

Example response

{
  "count": 120
}