elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.62k stars 8.22k forks source link

[Cases] Fix pushing API when using a different connector from the one assigned to case #106965

Open cnasikas opened 3 years ago

cnasikas commented 3 years ago

The push API of Cases supports pushing a case to different connectors. On the URL of the push endpoint, the user can set the case id and the connector id of her like.

POST /api/cases/{case_id}/connector/{connector_id}/_push

When you assign a connector to a case the connector is being saved to the case's SO. Example:

{
   "id":"fa62a8b0-ee31-11eb-b8c6-1bff836bf9c3",
   "title":"Test",
   "tags":[
      "some tags"
   ],
   "description":"a description",
   "connector":{
      "id":"3d6c7b20-e5ab-11eb-98bb-85a0e2a49315",
      "name":"Test",
      "type":".jira",
      "fields":{
         "issueType":"10002",
         "parent":null,
         "priority":"Highest"
      }
   },
   ...
}

At the moment, when you push using the API the fields of the connector are retrieved from the case's SO. For that reason, if you push to a connector that is not assigned to the case the fields will be empty even though they could be set previously.

Steps to reproduce:

  1. Create a case.
  2. Create a Jira connector.
  3. Create a ServiceNow connector.
  4. Set the case's connector to Jira + some fields.
  5. Set the case's connector to ServiceNow + some fields.
  6. Push through the API to Jira.
  7. Fields are not part of the cases SO so they are empty. No fields are being pushed to the external service.

To fix that we should retrieve the fields from the user actions as we do on the frontend.

This is not a problem on the UI because the user cannot push to another connector of the one being assigned to the case.

elasticmachine commented 3 years ago

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

elasticmachine commented 3 years ago

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine commented 2 years ago

Pinging @elastic/response-ops-cases (Feature:Cases)

elasticmachine commented 2 years ago

Pinging @elastic/response-ops (Team:ResponseOps)