v1

latestOpenAPI 3.1.0Elastic 2.02026-07-179371211.2 KB

Cases

Get Case

Retrieves a case given the provided case ID and returns the case details. Use the "Query Data" API to search for cases using other criteria, specifying a query parameter that includes the following, at a minimum: _index:"*:so-case"

get/connect/case/{id}

Path parameters

idstring required

The case ID to retrieve

Response

The case object

assigneeIdstring

The user ID that is assigned to work on this case.

categorystring

A category is a way to group similar cases together and can be arbitrary values, or static values, depending on how the system if configured.

completeTimestring

The date and time that the case was completed. A case is completed when the status is changed to 'closed'. This is a read-only field.

createTimestring

The date and time that this object was created. This is a read-only field.

descriptionstring

The full description of the case.

idstring

The ID assigned to this object by the server. This is a read-only field.

kindstring

The kind of object. This is a read-only field.

operationstring

The operation that was applied to the object. This is a read-only field.

papstring

The Permissiable Actions Protocol value.

priorityinteger

The priority of the case. Lower values typically represent increasing importance.

severitystring

The serverity of the case. Typical values are: critical, high, medium, low

startTimestring

The date and time that the case status was changed to 'in progress'. This is a read-only field.

statusstring

The state of the case. Typical values are: new, in progress, closed

tagsstring[]

A tag is another way to group similar cases together and can be arbitrary values, or static values, depending on how the system if configured.

templatestring

A case ID representing the case to use as a template when creating this case. The template case fields will be copied into the new case.

titlestring

The brief case title or summary

tlpstring

The Traffic Light Protocol value.

updateTimestring

The date and time that this object was last modified. This is a read-only field.

userIdstring

The user ID (or API client ID) that initiated this event. This is a read-only field.

Example response

{
  "assigneeId": "022d1936-6ca3-49c1-b3ee-6a5b27d1b8b1",
  "category": "general",
  "completeTime": "2024-11-14T15:33:02Z",
  "createTime": "2024-11-14T15:03:22Z",
  "description": "Discovered anomalous events during the overnight hours of November 14-15. Atypical large network volumes passed through SMTP server.",
  "id": "PdFc-JIBLkNJ8-bDfz47",
  "kind": "case",
  "operation": "create",
  "pap": "white",
  "priority": 1,
  "severity": "high",
  "startTime": "2024-11-14T15:03:22Z",
  "status": "new",
  "tags": [
    "pending",
    "confirmed"
  ],
  "template": "some_case_id_to_be_used_as_template",
  "title": "Possible intrusion via SMTP server",
  "tlp": "red",
  "updateTime": "2024-11-14T15:33:02Z",
  "userId": "socl_my_new_client"
}