Skip to content

Comments

[SIEM] [Docs] Cases API#761

Merged
benskelker merged 25 commits intoelastic:masterfrom
benskelker:siem_case_api
Apr 2, 2020
Merged

[SIEM] [Docs] Cases API#761
benskelker merged 25 commits intoelastic:masterfrom
benskelker:siem_case_api

Conversation

@benskelker
Copy link
Contributor

@benskelker benskelker commented Dec 17, 2019 •
edited
Loading

Documents cases API

Resolves #703

Preview

@benskelker benskelker force-pushed the siem_case_api branch 3 times, most recently from 1bf8752 to 8a55add Compare January 28, 2020 18:02
@benskelker benskelker force-pushed the siem_case_api branch 5 times, most recently from 4ae4179 to f96f2c9 Compare February 10, 2020 16:28
@benskelker benskelker force-pushed the siem_case_api branch 4 times, most recently from b8470ad to 1e6cc14 Compare February 20, 2020 14:01
@benskelker benskelker changed the title [SIEM] [Docs] Cases api [SIEM] [Docs] Cases API Feb 25, 2020
@benskelker benskelker marked this pull request as ready for review February 27, 2020 10:59
@benskelker
Copy link
Contributor Author

benskelker commented Feb 27, 2020

@stephmilovic
No rush with this, but when you get a chance please take a look to make sure I'm going in the right direction. If anyone else should review this, feel free to add them or ping me.

Thanks,

@benskelker benskelker force-pushed the siem_case_api branch 2 times, most recently from 63fdeeb to 5f46192 Compare March 3, 2020 08:39
@benskelker benskelker force-pushed the siem_case_api branch 2 times, most recently from 8f05b90 to ff5c401 Compare March 12, 2020 14:14
@benskelker benskelker requested review from XavierM and cnasikas March 17, 2020 10:08
@cnasikas
Copy link
Member

cnasikas commented Mar 17, 2020

This PR introduced new changes to the ServiceNow action API:

elastic/kibana#60052

stephmilovic
stephmilovic reviewed Apr 2, 2020
View reviewed changes
stephmilovic
stephmilovic reviewed Apr 2, 2020
View reviewed changes
stephmilovic
stephmilovic reviewed Apr 2, 2020
View reviewed changes
stephmilovic
stephmilovic reviewed Apr 2, 2020
View reviewed changes
stephmilovic
stephmilovic reviewed Apr 2, 2020
View reviewed changes
stephmilovic
stephmilovic requested changes Apr 2, 2020
View reviewed changes
Copy link

@stephmilovic stephmilovic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've reviewed the case and comment api docs. Let me know when you've made my requested updates. @cnasikas is going to review the configure/connect/actions stuff today as well

@benskelker
Copy link
Contributor Author

benskelker commented Apr 2, 2020

I've reviewed the case and comment api docs. Let me know when you've made my requested updates. @cnasikas is going to review the configure/connect/actions stuff today as well

Thanks - will do

stephmilovic
stephmilovic reviewed Apr 2, 2020
View reviewed changes
stephmilovic
stephmilovic reviewed Apr 2, 2020
View reviewed changes
@cnasikas
Copy link
Member

cnasikas commented Apr 2, 2020 •
edited
Loading

Hi!

Notes:

  • Create or update an external incident: If an error is produced by our connector the response code will be 200 but the status in the response will be error. Example: { actionId: "ba7be107-5826-48b7-b9d2-43d456fada00", status: "error", message: "an error occurred while running the action executor", serviceMessage: "[Action][ServiceNow]: Unable to create incident. Error: Request failed with status code 404", retry: false }.

  • Update case configuration

    • Fields are optional except version.
    • connector_name is missing (also optional).

  • Reporter's API is missing:

    • Route: /api/cases/reporters
    • Method: GET
    • Response: Array of { email, fullname, username }

  • User actions API is missing

  • Find cases route is missing the following fields: fields, defaultSearchOperator, search, searchFields. @XavierM Should we document these fields?

stephmilovic
stephmilovic approved these changes Apr 2, 2020
View reviewed changes
Copy link

@stephmilovic stephmilovic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM on the cases and comments. Please wait for @cnasikas approval before merging. Thanks @benskelker for keeping up with all of our changes 🚀

XavierM
XavierM reviewed Apr 2, 2020
View reviewed changes
@XavierM XavierM mentioned this pull request Apr 2, 2020
Merged
@cnasikas
Copy link
Member

cnasikas commented Apr 2, 2020

LGTM! Thank you!

@benskelker benskelker merged commit 81c20d9 into elastic:master Apr 2, 2020
benskelker added a commit to benskelker/stack-docs that referenced this pull request Apr 2, 2020
@benskelker
[SIEM] [Docs] Cases API (elastic#761)
61aa715 
* intial case api docs

* starts updating the api

* updates patch comments

* api updates

* starts conf api

* more conf api stuff

* minor fixes

* more updates

* proofing

* typo

* formatting

* gets rid of me

* adds delete all comments method

* corrections after feedback

* corrections 2

* corrections continued

* cmore corrections

* and more corrections

* even more

* rebase

* adds reporters to find

* corrections

* corrections II

* connector corrections

* final corrections
@benskelker benskelker mentioned this pull request Apr 2, 2020
Merged
benskelker added a commit to benskelker/stack-docs that referenced this pull request Apr 2, 2020
@benskelker
[SIEM] [Docs] Cases API (elastic#761)
642f3a4 
* intial case api docs

* starts updating the api

* updates patch comments

* api updates

* starts conf api

* more conf api stuff

* minor fixes

* more updates

* proofing

* typo

* formatting

* gets rid of me

* adds delete all comments method

* corrections after feedback

* corrections 2

* corrections continued

* cmore corrections

* and more corrections

* even more

* rebase

* adds reporters to find

* corrections

* corrections II

* connector corrections

* final corrections
@benskelker benskelker mentioned this pull request Apr 2, 2020
Merged
benskelker added a commit that referenced this pull request Apr 3, 2020
@benskelker
[SIEM] [Docs] Cases API (#761) (#977)
964419c 
* intial case api docs

* starts updating the api

* updates patch comments

* api updates

* starts conf api

* more conf api stuff

* minor fixes

* more updates

* proofing

* typo

* formatting

* gets rid of me

* adds delete all comments method

* corrections after feedback

* corrections 2

* corrections continued

* cmore corrections

* and more corrections

* even more

* rebase

* adds reporters to find

* corrections

* corrections II

* connector corrections

* final corrections
benskelker added a commit that referenced this pull request Apr 3, 2020
@benskelker
[SIEM] [Docs] Cases API (#761) (#976)
5329c68 
* intial case api docs

* starts updating the api

* updates patch comments

* api updates

* starts conf api

* more conf api stuff

* minor fixes

* more updates

* proofing

* typo

* formatting

* gets rid of me

* adds delete all comments method

* corrections after feedback

* corrections 2

* corrections continued

* cmore corrections

* and more corrections

* even more

* rebase

* adds reporters to find

* corrections

* corrections II

* connector corrections

* final corrections
@benskelker benskelker deleted the siem_case_api branch April 3, 2020 05:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@XavierM XavierM XavierM left review comments

@cnasikas cnasikas cnasikas left review comments

@stephmilovic stephmilovic stephmilovic approved these changes

Assignees

No one assigned

Labels

Team:SIEM v7.7.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Docs] Document case management API

4 participants

@benskelker @cnasikas @XavierM @stephmilovic