Open cnasikas opened 3 years ago
Pinging @elastic/security-threat-hunting (Team:Threat Hunting)
Pinging @elastic/security-solution (Team: SecuritySolution)
Pinging @elastic/response-ops-cases (Feature:Cases)
Pinging @elastic/response-ops (Team:ResponseOps)
The push API of Cases supports pushing a case to different connectors. On the URL of the push endpoint, the user can set the case id and the connector id of her like.
POST /api/cases/{case_id}/connector/{connector_id}/_push
When you assign a connector to a case the connector is being saved to the case's SO. Example:
At the moment, when you push using the API the fields of the connector are retrieved from the case's SO. For that reason, if you push to a connector that is not assigned to the case the fields will be empty even though they could be set previously.
Steps to reproduce:
To fix that we should retrieve the fields from the user actions as we do on the frontend.
This is not a problem on the UI because the user cannot push to another connector of the one being assigned to the case.