The SIEM app is now a part of the Elastic Security solution. Click here to view SIEM documentation for previous releases.
« Create case Update case »
Elastic Docs ›Elastic Security Solution [7.9] ›Elastic Security APIs ›Cases API

Add comment

edit

Add comment

edit

Adds a comment to an existing case.

Request URL

edit

POST <kibana host>:<port>/api/cases/<case ID>/comments

URL parts

edit

The URL must include the case ID of the case to which you are adding a comment. Call Find cases to retrieve case IDs.

Request body

edit

A JSON object with a comment field:

Name Type Description Required

comment

String

The case’s new comment.

Yes

Example request

edit

Adds a comment to case ID 293f1bc0-74f6-11ea-b83a-553aecdb28b6:

POST api/cases/293f1bc0-74f6-11ea-b83a-553aecdb28b6/comments
{
  "comment": "That is nothing - Ethan Hunt answered a targeted social
  media campaign promoting phishy pension schemes to IMF operatives."
}

Response code

edit
200
Indicates a successful call.

Response payload

edit

The updated JSON case object with the new comment, the user who created the comment, and the comment’s ID, version, and creation time.

Example response

edit
  "id": "293f1bc0-74f6-11ea-b83a-553aecdb28b6",
  "version": "WzIwNDMyLDFd",
  "comments": [
    {
      "id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6",
      "version": "WzIwNDMxLDFd",
      "comment": "That is nothing - Ethan Hunt answered a targeted social media campaign promoting phishy pension schemes to IMF operatives.",
      "created_at": "2020-04-02T15:28:03.034Z",
      "created_by": {
        "email": "[email protected]",
        "full_name": "Ms Moneypenny",
        "username": "moneypenny"
      },
      "pushed_at": null,
      "pushed_by": null,
      "updated_at": null,
      "updated_by": null
    }
  ],
  "totalComment": 0,
  "title": "This case will self-destruct in 5 seconds",
  "tags": [
    "phishing",
    "social engineering"
  ],
  "description": "James Bond clicked on a highly suspicious email banner advertising cheap holidays for underpaid civil servants.",
  "closed_at": null,
  "closed_by": null,
  "created_at": "2020-04-02T15:25:19.088Z",
  "created_by": {
    "email": "[email protected]",
    "full_name": "Alan Hunley",
    "username": "ahunley"
  },
  "external_service": null,
  "status": "open",
  "updated_at": "2020-04-02T15:28:03.034Z",
  "updated_by": {
    "email": "[email protected]",
    "full_name": "Ms Moneypenny",
    "username": "moneypenny"
  }
}
« Create case Update case »