Skip to content

Commit 24d199f

Browse files
nastasha-solomonjoepeeples
authored and
mergify[bot]
committed
[DOCS] Add Webhook connector to case and connector docs #2221 (#2297)
Co-authored-by: Joe Peeples <[email protected]> (cherry picked from commit 8a1f28d)
1 parent df1630f commit 24d199f

File tree

2 files changed

+12
-136
lines changed

2 files changed

+12
-136
lines changed

‎docs/cases/cases-overview.asciidoc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,12 @@ Collect and share information about security issues by opening a case in {elasti
77

88
You can also send cases to these external systems by <<cases-ui-integrations, configuring external connectors>>:
99

10-
* {sn} ITSM
11-
* {sn} SecOps
10+
* {sn-itsm}
11+
* {sn-sir}
1212
* {jira} (including Jira Service Desk)
1313
* {ibm-r}
1414
* {swimlane}
15+
* {webhook-cm}
1516

1617
[role="screenshot"]
1718
image::images/cases-home-page.png[Case UI Home]

‎docs/cases/cases-ui-integrations.asciidoc‎

Lines changed: 9 additions & 134 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ You can push {es-sec} cases to these third-party systems:
99
* {jira} (including Jira Service Desk)
1010
* {ibm-r}
1111
* {swimlane}
12+
* {webhook-cm}
1213

1314
To push cases, you need to create a connector, which stores the information required to interact with an external system. After you have created a connector, you can set {es-sec} cases to automatically close when they are sent to external systems.
1415

@@ -24,140 +25,14 @@ https://www.elastic.co/subscriptions[appropriate license], and your role needs *
2425
[role="screenshot"]
2526
image::images/cases-ui-connector.png[Shows the page for creating connectors]
2627
. From the *Incident management system* list, select *Add new connector*.
27-
. Select the system to send cases to: *{sn}*, *{jira}*, *{ibm-r}*, or *{swimlane}*.
28-
29-
+
30-
IMPORTANT: If you've upgraded from {stack} version 7.15.0 or earlier to 7.16.0 or later, you must complete several prerequisites before creating a new {sn-itsm} or {sn-sir} connector. For more information, refer to prerequisites for {kibana-ref}/servicenow-action-type.html#servicenow-itsm-connector-prerequisites[{sn-itsm}] and {kibana-ref}/servicenow-sir-action-type.html#servicenow-sir-connector-prerequisites[{sn-sir}].
31-
32-
. Enter your required settings.
33-
+
34-
|===
35-
36-
| *Connector name* | Name for the connector.
37-
38-
| *URL* | ({ibm-r} and {jira} only) The URL of the external system to which you want to send cases.
39-
40-
| *{sn} instance URL* | ({sn} only) The URL of the {sn} instance to which you want to send cases.
41-
42-
| *Use OAuth authentication* | ({sn} only) Enable this to use open authorization (OAuth) to authenticate a connection between Elastic and {sn}.
43-
44-
To use open authorization (OAuth), you must {kibana-ref}/servicenow-action-type.html#servicenow-itsm-connector-prerequisites-rsa-key[create an RSA keypair and add an X.509 Certificate] and also {kibana-ref}/servicenow-action-type.html#servicenow-itsm-connector-prerequisites-endpoint[create an OAuth JWT API endpoint for external clients with a JWT Verifiers Map.]
45-
46-
| *API URL* | ({swimlane} only) The URL of the {swimlane} instance to which you want to send cases.
47-
48-
| *Organization ID* | ({ibm-r} only) Your organization’s {ibm-r} ID number.
49-
50-
| *Application ID* | ({swimlane} only) The application ID of your {swimlane} application. From {swimlane}, you can find the application
51-
ID by checking your application’s settings or at the end of your application’s URL after you’ve opened it.
52-
53-
| *Username* | ({sn} only and displays if *Use OAuth authentication* is turned off) The username of the {sn} account used to access the {sn} instance.
54-
55-
| *Password* | ({sn} only and displays if *Use OAuth authentication* is turned off) The password of the {sn} account used to access the {sn} instance.
56-
57-
| *Client ID* | ({sn} only and displays if *Use OAuth authentication* is turned on) The client ID assigned to your OAuth application.
58-
59-
| *User Identifier* | ({sn} only and displays if *Use OAuth authentication* is turned on) Identifier to use for OAuth type authentication. Use the value you entered into the *User field* when you created an OAuth JWT API endpoint for external clients.
60-
61-
| *JWT Verifier Key ID* | ({sn} only and displays if *Use OAuth authentication* is turned on) The key ID assigned to the JWT Verifier Map of your OAuth application.
62-
63-
| *Client Secret* | ({sn} only and displays if *Use OAuth authentication* is turned on) The client secret assigned to your OAuth application.
64-
65-
| *Private Key* | ({sn} only and displays if *Use OAuth authentication* is turned on) The RSA private key generated when you created an RSA keypair.
66-
67-
| *Private Key Password* | ({sn} only and displays only if *Use OAuth authentication* is turned on) The The password for the RSA private key generated during setup, if set.
68-
69-
| *Project key* | ({jira} only) The key of the {jira} project to which you are sending cases.
70-
71-
| *Email address* | ({jira} only) The {jira} account username or email.
72-
73-
| *API token* | ({jira} only) The API token or password is used to authenticate {jira} updates.
74-
75-
| *API key ID* | ({ibm-r} only) The API key is used to authenticate {ibm-r} updates.
76-
77-
| *API key secret* | ({ibm-r} only) The API key secret is used to authenticate {ibm-r} updates.
78-
79-
| *API token* | ({swimlane} only) The {swimlane} API authentication token is used for HTTP Basic authentication.
80-
This is the personal access token for your user role.
81-
82-
|===
83-
+
84-
. Choose the connector type ({swimlane} only):
85-
+
86-
|===
87-
88-
| *All* | You can choose to set all or no field mappings when creating your new {swimlane} connector. However, note that if
89-
you don’t set field mappings now, you’ll be prompted to do so if you want to use the connector for a case or a rule.
90-
91-
| *Alerts* | Provide an alert ID and rule name.
92-
93-
| *Cases* | Provide a case ID, a case name, comments, and a description.
94-
95-
|===
96-
+
97-
. Save the connector.
98-
99-
TIP: To learn how to connect {elastic-sec} to {jira}, check out the <<connect-security-to-jira, tutorial>> at the end of this topic.
100-
101-
[float]
102-
[[mapped-case-fields]]
103-
=== Mapped case fields
104-
105-
To represent an {es-sec} case in an external system, {es-sec} case fields are
106-
mapped as follows:
107-
108-
NOTE: Data from mapped case fields can be pushed to external systems but cannot be pulled in.
109-
110-
* For {sn} incidents:
111-
+
112-
|===
113-
114-
| *Title* | Mapped to the {sn} `Short description` field. When an update to a case title is sent to {sn}, the existing {sn} `Short description` field is overwritten.
115-
116-
| *Description* | Mapped to the {sn} `Description` field. When an update to a case description is sent to {sn}, the existing {sn} `Description` field is overwritten.
117-
118-
| *Comments* | Mapped to the {sn} `Work Notes` field. When a comment is updated in a case, a new comment is added to the {sn} incident.
119-
120-
|===
121-
+
122-
123-
* For {jira} issues:
124-
+
125-
|===
126-
127-
| *Title* | Mapped to the {jira} `Summary` field. When an update to a case title is sent to {jira}, the existing {jira} `Summary` field is overwritten.
128-
129-
| *Description* | Mapped to the {jira} `Description` field. When an update to a case description is sent to {jira}, the existing {jira} `Description` field is overwritten.
130-
131-
| *Comments* | Mapped to the {jira} `Comments` field. When a comment is updated in a case, a new comment is added to the {jira} incident.
132-
133-
|===
134-
+
135-
136-
* For {ibm-r} issues:
137-
+
138-
|===
139-
140-
| *Title* | Mapped to the {ibm-r} `Name` field. When an update to a case title is sent to {ibm-r}, the existing {ibm-r} `Name` field is overwritten.
141-
142-
| *Description* | Mapped to the {ibm-r} `Description` field. When an update to a case description is sent to {ibm-r}, the existing {ibm-r} `Description` field is overwritten.
143-
144-
| *Comments* | Mapped to the {ibm-r} `Comments` field. When a comment is updated in a case, a new comment is added to the {ibm-r} incident.
145-
146-
|===
147-
+
148-
149-
* For {swimlane} records:
150-
+
151-
|===
152-
153-
| *Title* | Mapped to the {swimlane} `caseName` field. When an update to a case title is sent to {swimlane}, the field that is mapped to the {swimlane} `caseName` field is
154-
overwritten.
155-
156-
| *Description* | Mapped to the {swimlane} `Description` field. When an update to a case description is sent to {swimlane}, the field that is mapped to the {swimlane} `Description` field is overwritten.
157-
158-
| *Comments* | Mapped to the {swimlane} `Comments` field. When a new comment is added to a case, or an existing one is updated, the field that is mapped to the {swimlane} `Comment` field is appended. Comments are posted to the {swimlane} incident record individually.
159-
160-
|===
28+
. Select the system to send cases to: *{sn}*, *{jira}*, *{ibm-r}*, *{swimlane}*, or *{webhook-cm}*.
29+
. Enter your required settings. For connector configuration details, refer to:
30+
- {kibana-ref}/servicenow-action-type.html[{sn-itsm} connector]
31+
- {kibana-ref}/servicenow-sir-action-type.html[{sn-sir} connector]
32+
- {kibana-ref}/jira-action-type.html[{jira} connector]
33+
- {kibana-ref}/resilient-action-type.html[{ibm-r} connector]
34+
- {kibana-ref}/swimlane-action-type.html[{swimlane} connector]
35+
- {kibana-ref}/cases-webhook-action-type.html[{webhook-cm} connector]
16136

16237
[[close-connector]]
16338
[float]

0 commit comments

Comments
 (0)