[SIEM] [Case] Establish API and schema

[stephmilovic]

• write a “case” document structure/schema/index using ECS fields
• write an API to create and manage these documents

Meta for case: #50103

[stephmilovic]

Rough planning...

API endpoints
GET /cases
List, search, filter issues

GET /cases/<number>
Get a single issue document

POST /cases
Post a new case

PATCH /cases/<number>
Update a case with labels, title, description, etc.

POST /cases/<number>/comments
Post a new comment

PATCH /cases/<number>/comments/<comment-id>
Update a comment

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[stephmilovic]

WIP mappings.json:

{
  "mappings" : {
    "dynamic": false,
    "properties" : {
      "assignees" : {
        "properties" : {
          "name" : {
            "type" : "keyword",
            "ignore_above" : 1024
          }
        }
      },
      "comments" : {
        "properties" : {
          "comment" : {
            "type" : "keyword",
            "ignore_above" : 1024
          },
          "creation_date" : {
            "type" : "date"
          },
          "id" : {
            "type" : "keyword",
            "ignore_above" : 1024
          },
          "last_edit_date" : {
            "type" : "date"
          },
          "user" : {
            "properties" : {
              "id" : {
                "type" : "keyword",
                "ignore_above" : 1024
              },
              "name" : {
                "type" : "keyword",
                "ignore_above" : 1024
              }
            }
          }
        }
      },
      "creation_date" : {
        "type" : "date"
      },
      "description" : {
        "type" : "keyword",
        "ignore_above" : 1024
      },
      "id" : {
        "type" : "keyword",
        "ignore_above" : 1024
      },
      "last_edit_date" : {
        "type" : "date"
      },
      "name" : {
        "type" : "keyword",
        "ignore_above" : 1024
      },
      "reporter" : {
        "properties" : {
          "id" : {
            "type" : "keyword",
            "ignore_above" : 1024
          },
          "name" : {
            "type" : "keyword",
            "ignore_above" : 1024
          }
        }
      },
      "state" : {
        "type" : "keyword",
        "ignore_above" : 1024
      },
      "tags" : {
        "type" : "keyword",
        "ignore_above" : 1024
      },
      "type" : {
        "type" : "keyword",
        "ignore_above" : 1024
      }
    }
  }
}

[stephmilovic]

example post:

{
  "creation_date": "2019-08-05T20:52:51.583Z",
  "description": "This is a brand new case of a bad meanie defacing data",
  "id": "case-jyyvppav1tj69d00628097g1",
  "last_edit_date": "2019-08-06T20:52:51.583Z",
  "name": "Super Bad Security Issue",
  "reporter": {
    "id": "user-1234",
    "name": "Astronaut Mike Dexter"
  },
  "state": "open",
  "type": "security",
  "assignees": [
    {
      "id": "user-5678",
      "name": "Hazel Wassername"
    }
  ],
  "comments": [
    {
      "id": "comment-1234",
      "comment": "This looks really bad, good luck with that",
      "creation_date": "2019-08-06T20:52:51.583Z",
      "last_edit_date": "2019-08-06T20:52:51.583Z",
      "user": {
        "id": "user-9101",
        "name": "Dr Spaceman"
      }
    }
  ],
  "tags": [
    "defacement"
  ]
}