Module cases 

Cases and their comments. Updates use optimistic concurrency through case versions.

Create a NewCase, then build CasePatch values with the IDs and versions from the latest read. The owner identifies the Kibana solution handling the case; comments must use the same owner. NewCase::security and SECURITY_OWNER select the Security solution.

Structs

AddComment

POST /api/cases/{caseId}/comments

Case

A case returned by Kibana. Use its ID and current version to build a CasePatch.

CaseComment

A comment body for Cases::add_comment.

CasePage

CasePatch

Changes to one case. Only the fields set here are sent. Unset fields retain their server values; an empty tag list removes all tags.

Cases

CommentPage

CreateCase

POST /api/cases

DeleteCases

DELETE /api/cases

FindCases

GET /api/cases/_find

FindComments

GET /api/cases/{caseId}/comments/_find

GetCase

GET /api/cases/{caseId}

NewCase

A case definition for Cases::create. Cases have no external connector and do not sync alert status unless configured.

UpdateCases

PATCH /api/cases

Enums

CaseStatus

Constants

SECURITY_OWNER

The case owner used by the Security solution.