CasesClient¶

Client for the Kibana Cases API.

Cases are used to open and track issues directly in Kibana. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.

Cases are space-scoped: every method accepts an optional space_id to target a specific space (None targets the default space or the space the client is scoped to).

class kibana._sync.client.cases.CasesClient(client, default_space_id=None, validate_spaces=True)[source]¶

Bases: NamespaceClient

Client for the Kibana Cases API.

Cases are space-scoped: every method accepts an optional space_id to target a specific space (None targets the default space or the space the client is scoped to).

Example

>>> from kibana import Kibana
>>> client = Kibana("http://localhost:5601", api_key="...")
>>>
>>> # Create a case, comment on it, then close and delete it
>>> case = client.cases.create(
...     title="Suspicious login activity",
...     description="Multiple failed logins detected.",
...     tags=["security"],
... )
>>> case_id = case.body["id"]
>>> client.cases.add_comment(
...     case_id=case_id, comment="Investigating.", owner="cases"
... )
>>> updated = client.cases.update(
...     id=case_id, version=case.body["version"], status="closed"
... )
>>> client.cases.delete(ids=[case_id])

Creating and Updating Cases

Create a case, comment on it, then close it:

from kibana import Kibana

client = Kibana("http://localhost:5601", api_key="your_api_key")

# Create a case
case = client.cases.create(
    title="Suspicious login activity",
    description="Multiple failed logins detected.",
    tags=["security"],
)
case_id = case.body["id"]

# Add a comment
client.cases.add_comment(
    case_id=case_id, comment="Investigating.", owner="cases"
)

# Close the case (updates are versioned)
updated = client.cases.update(
    id=case_id, version=case.body["version"], status="closed"
)

Finding Cases

Search cases with find(). The response contains the page of cases plus per-status counts:

results = client.cases.find(tags=["security"])

print(f"Open cases: {results.body['count_open_cases']}")
for case in results.body["cases"]:
    print(case["id"], case["title"], case["status"])

Comments and User Actions

# List comments on a case
comments = client.cases.get_comments(case_id=case_id)

# Retrieve the full activity (user actions) of a case
actions = client.cases.find_user_actions(case_id=case_id)

External Incident Management Systems

Cases can be pushed to external systems (Jira, ServiceNow, …) through connectors:

# List connectors available for cases
connectors = client.cases.find_connectors()

# Configure the default connector and settings for an owner
config = client.cases.create_configuration(
    owner="cases",
    connector={
        "id": "jira-connector-id",
        "name": "Jira",
        "type": ".jira",
        "fields": None,
    },
    closure_type="close-by-user",
)

# Push a case to the configured external system
client.cases.push(case_id=case_id, connector_id="jira-connector-id")

Alerts Attached to Cases

# Get all alerts attached to a case
alerts = client.cases.get_alerts(case_id=case_id)

# Find the cases an alert is attached to
cases = client.cases.get_cases_by_alert(alert_id="alert-id")

Deleting Cases

# Delete one or more cases by ID
client.cases.delete(ids=[case_id])

__init__(client, default_space_id=None, validate_spaces=True)[source]¶

Initialize the CasesClient.

Parameters:

client (Kibana) – The parent Kibana client instance to delegate requests to.
default_space_id (str | None) – Optional default space ID for all operations.
validate_spaces (bool) – Whether to validate space existence before space-scoped operations (default: True).

Example

>>> cases_client = CasesClient(kibana_client)

create(*, title, description, owner='cases', tags=None, connector=None, settings=None, assignees=None, category=None, custom_fields=None, severity=None, space_id=None, validate_spaces=None)[source]¶

Create a case.

You must have all privileges for the Cases feature in the Management, Observability, or Security section of the Kibana feature privileges, depending on the owner of the case you’re creating.

Parameters:

title (str) – A title for the case (maximum 160 characters).
description (str) – The description for the case.
owner (str) – The application that owns the case: "cases" (Stack Management, the default), "observability", or "securitySolution".
tags (list[str] | None) – Words and phrases that help categorize cases. Defaults to an empty list (the API requires the field to be present).
connector (dict[str, Any] | None) – An object that contains the connector configuration (id, name, type, fields). Defaults to the “none” connector when omitted.
settings (dict[str, Any] | None) – An object that contains the case settings, e.g. {"syncAlerts": True}. Defaults to {"syncAlerts": False} when omitted (the API requires the field to be present).
assignees (list[dict[str, Any]] | None) – A list of users assigned to the case, each an object with a uid (user profile unique identifier). Requires a Platinum or Enterprise license.
category (str | None) – A word or phrase that categorizes the case (maximum 50 characters).
custom_fields (list[dict[str, Any]] | None) – Custom field values for the case, each an object with key, type and value. Any optional custom fields not specified are set to null.
severity (str | None) – The severity of the case: "critical", "high", "low" (server default), or "medium".
space_id (str | None) – Optional space ID to create the case in.
validate_spaces (bool | None) – Override space validation setting for this operation.

Returns:

ObjectApiResponse containing the created case, including its id, version, status, created_at/created_by metadata, and the fields supplied on creation.

Raises:

BadRequestError – If the request body is invalid.
AuthenticationException – If authentication fails.
AuthorizationException – If insufficient privileges.
SpaceNotFoundError – If the space doesn’t exist and validation is enabled.

Return type:

CasesClient¶

AsyncCasesClient¶