Webhook - Case Management connector JSON payload from case object variables

Elastic Security SIEM
1

Is it possible to pass a richer context to an External incident management system by object variables?
currently, the documentation only explains the following:

{
	"fields": {
	  "summary": {{{case.title}}},
	  "description": {{{case.description}}},
	  "labels": {{{case.tags}}}
	}
}

How i can add to the case object fields body the JSON payload of the associated alerts or any other relevant information, even the attached files?

Thanks

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.